The FreeRADIUS server $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
Loading...
Searching...
No Matches
bio.c
Go to the documentation of this file.
1/*
2 * This program is is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License as published by
4 * the Free Software Foundation; either version 2 of the License, or (at
5 * your option) any later version.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
15 */
16
17/**
18 * $Id: 1a1c5b53f731732ec9004688d3760f089021df17 $
19 * @file src/modules/rlm_radius/bio.c
20 * @brief RADIUS BIO transport
21 *
22 * @copyright 2017 Network RADIUS SAS
23 * @copyright 2020 Arran Cudbard-Bell (a.cudbardb@freeradius.org)
24 */
25
26#include <freeradius-devel/io/application.h>
27#include <freeradius-devel/io/listen.h>
28#include <freeradius-devel/io/pair.h>
29#include <freeradius-devel/missing.h>
30#include <freeradius-devel/server/connection.h>
31#include <freeradius-devel/util/debug.h>
32#include <freeradius-devel/util/heap.h>
33#include <freeradius-devel/util/rb_expire.h>
34
35#include <sys/socket.h>
36
37//#include "rlm_radius.h"
38#include "track.h"
39
40/*
41 * Macro to simplify checking packets before calling decode(), so that
42 * it gets a known valid length and no longer calls fr_radius_ok() itself.
43 */
44#define check(_handle, _len_p) fr_radius_ok((_handle)->buffer, (size_t *)(_len_p), \
45 (_handle)->ctx.inst->max_attributes, false, NULL)
46
47typedef struct {
48 char const *module_name; //!< the module that opened the connection
49 rlm_radius_t const *inst; //!< our instance
50 fr_event_list_t *el; //!< Event list.
51 trunk_t *trunk; //!< trunk handler
52 fr_bio_fd_config_t fd_config; //!< for threads or sockets
53 fr_bio_fd_info_t const *fd_info; //!< status of the FD.
54 fr_radius_ctx_t radius_ctx;
55} bio_handle_ctx_t;
56
57typedef struct {
58 bio_handle_ctx_t ctx; //!< common struct for home servers and BIO handles
59
60 struct {
61 fr_bio_t *fd; //!< writing
62 uint32_t id; //!< for replication
63 fr_rb_expire_t expires; //!< for proxying / client sending
64 } bio;
65} bio_thread_t;
66
67typedef struct bio_request_s bio_request_t;
68
69/** Track the handle, which is tightly correlated with the FD
70 *
71 */
72typedef struct {
73 bio_handle_ctx_t ctx; //!< common struct for home servers and BIO handles
74
75 int fd; //!< File descriptor.
76
77 struct {
78 fr_bio_t *read; //!< what we use for input
79 fr_bio_t *write; //!< what we use for output
80 fr_bio_t *fd; //!< raw FD
81 fr_bio_t *mem; //!< memory wrappers for stream sockets
82 } bio;
83
84 connection_t *conn;
85
86 uint8_t last_id; //!< Used when replicating to ensure IDs are distributed
87 ///< evenly.
88
89 uint32_t max_packet_size; //!< Our max packet size. may be different from the parent.
90
91 uint8_t *buffer; //!< Receive buffer.
92 size_t buflen; //!< Receive buffer length.
93
94 radius_track_t *tt; //!< RADIUS ID tracking structure.
95
96 fr_time_t mrs_time; //!< Most recent sent time which had a reply.
97 fr_time_t last_reply; //!< When we last received a reply.
98 fr_time_t first_sent; //!< first time we sent a packet since going idle
99 fr_time_t last_sent; //!< last time we sent a packet.
100 fr_time_t last_idle; //!< last time we had nothing to do
101
102 fr_event_timer_t const *zombie_ev; //!< Zombie timeout.
103
104 bool status_checking; //!< whether we're doing status checks
105 bio_request_t *status_u; //!< for sending status check packets
106 request_t *status_request;
107} bio_handle_t;
108
109
110/** Connect request_t to local tracking structure
111 *
112 */
113struct bio_request_s {
114 trunk_request_t *treq;
115 rlm_rcode_t rcode; //!< from the transport
116 bool is_retry;
117
118 uint32_t priority; //!< copied from request->async->priority
119 fr_time_t recv_time; //!< copied from request->async->recv_time
120
121 uint32_t num_replies; //!< number of reply packets, sent is in retry.count
122
123 bool status_check; //!< is this packet a status check?
124 bool proxied; //!< is this request being proxied
125
126 fr_pair_list_t extra; //!< VPs for debugging, like Proxy-State.
127
128 uint8_t code; //!< Packet code.
129 uint8_t id; //!< Last ID assigned to this packet.
130 uint8_t *packet; //!< Packet we write to the network.
131 size_t packet_len; //!< Length of the packet.
132 size_t partial; //!< partially sent data
133
134 radius_track_entry_t *rr; //!< ID tracking, resend count, etc.
135 fr_event_timer_t const *ev; //!< timer for retransmissions
136 fr_retry_t retry; //!< retransmission timers
137};
138
139typedef struct {
140 bio_handle_ctx_t ctx; //!< for copying to bio_handle_t
141
142 fr_rb_expire_node_t expire;
143} home_server_t;
144
145/** Turn a reply code into a module rcode;
146 *
147 */
163
164static void conn_init_writable(UNUSED fr_event_list_t *el, UNUSED int fd,
165 UNUSED int flags, void *uctx);
166
167static int encode(bio_handle_t *h, request_t *request, bio_request_t *u, uint8_t id);
168
169static fr_radius_decode_fail_t decode(TALLOC_CTX *ctx, fr_pair_list_t *reply, uint8_t *response_code,
170 bio_handle_t *h, request_t *request, bio_request_t *u,
171 uint8_t const request_authenticator[static RADIUS_AUTH_VECTOR_LENGTH],
172 uint8_t *data, size_t data_len);
173
174static void protocol_error_reply(bio_request_t *u, bio_handle_t *h);
175
176static void mod_write(request_t *request, trunk_request_t *treq, bio_handle_t *h);
177
178static int _bio_request_free(bio_request_t *u);
179
180static int8_t home_server_cmp(void const *one, void const *two);
181
182#ifndef NDEBUG
183/** Log additional information about a tracking entry
184 *
185 * @param[in] te Tracking entry we're logging information for.
186 * @param[in] log destination.
187 * @param[in] log_type Type of log message.
188 * @param[in] file the logging request was made in.
189 * @param[in] line logging request was made on.
190 */
191static void bio_tracking_entry_log(fr_log_t const *log, fr_log_type_t log_type, char const *file, int line,
192 radius_track_entry_t *te)
193{
194 request_t *request;
195
196 if (!te->request) return; /* Free entry */
197
198 request = talloc_get_type_abort(te->request, request_t);
199
200 fr_log(log, log_type, file, line, "request %s, allocated %s:%d", request->name,
201 request->alloc_file, request->alloc_line);
202
203 trunk_request_state_log(log, log_type, file, line, talloc_get_type_abort(te->uctx, trunk_request_t));
204}
205#endif
206
207/** Clear out any connection specific resources from a udp request
208 *
209 */
210static void bio_request_reset(bio_request_t *u)
211{
212 TALLOC_FREE(u->packet);
213 fr_pair_list_free(&u->extra);
214
215 /*
216 * Can have packet put no u->rr
217 * if this is part of a pre-trunk status check.
218 */
219 if (u->rr) radius_track_entry_release(&u->rr);
220
221 fr_assert(!u->ev);
222}
223
224/** Reset a status_check packet, ready to reuse
225 *
226 */
227static void status_check_reset(bio_handle_t *h, bio_request_t *u)
228{
229 fr_assert(u->status_check == true);
230
231 h->status_checking = false;
232 u->num_replies = 0; /* Reset */
233 u->retry.start = fr_time_wrap(0);
234
235 if (u->ev) (void) fr_event_timer_delete(&u->ev);
236
237 bio_request_reset(u);
238}
239
240/*
241 * Status-Server checks. Manually build the packet, and
242 * all of its associated glue.
243 */
244static void CC_HINT(nonnull) status_check_alloc(bio_handle_t *h)
245{
246 bio_request_t *u;
247 request_t *request;
248 rlm_radius_t const *inst = h->ctx.inst;
249 map_t *map = NULL;
250
251 fr_assert(!h->status_u && !h->status_request);
252
253 MEM(request = request_local_alloc_external(h, NULL));
254 MEM(u = talloc_zero(request, bio_request_t));
255 talloc_set_destructor(u, _bio_request_free);
256
257 h->status_u = u;
258
259 h->status_request = request;
260 fr_pair_list_init(&u->extra);
261
262 /*
263 * Status checks are prioritized over any other packet
264 */
265 u->priority = ~(uint32_t) 0;
266 u->status_check = true;
267
268 /*
269 * Allocate outside of the free list.
270 * There appears to be an issue where
271 * the thread destructor runs too
272 * early, and frees the freelist's
273 * head before the module destructor
274 * runs.
275 */
276 request->async = talloc_zero(request, fr_async_t);
277 talloc_const_free(request->name);
278 request->name = talloc_strdup(request, h->ctx.module_name);
279
280 request->packet = fr_packet_alloc(request, false);
281 request->reply = fr_packet_alloc(request, false);
282
283 /*
284 * Create the VPs, and ignore any errors
285 * creating them.
286 */
287 while ((map = map_list_next(&inst->status_check_map, map))) {
288 (void) map_to_request(request, map, map_to_vp, NULL);
289 }
290
291 /*
292 * Ensure that there's a NAS-Identifier, if one wasn't
293 * already added.
294 */
295 if (!fr_pair_find_by_da(&request->request_pairs, NULL, attr_nas_identifier)) {
296 fr_pair_t *vp;
297
298 MEM(pair_append_request(&vp, attr_nas_identifier) >= 0);
299 fr_pair_value_strdup(vp, "status check - are you alive?", false);
300 }
301
302 /*
303 * Always add an Event-Timestamp, which will be the time
304 * at which the first packet is sent. Or for
305 * Status-Server, the time of the current packet.
306 */
307 if (!fr_pair_find_by_da(&request->request_pairs, NULL, attr_event_timestamp)) {
308 MEM(pair_append_request(NULL, attr_event_timestamp) >= 0);
309 }
310
311 /*
312 * Initialize the request IO ctx. Note that we don't set
313 * destructors.
314 */
315 u->code = inst->status_check;
316 request->packet->code = u->code;
317
318 DEBUG3("%s - Status check packet type will be %s", h->ctx.module_name, fr_radius_packet_name[u->code]);
319 log_request_pair_list(L_DBG_LVL_3, request, NULL, &request->request_pairs, NULL);
320}
321
322/** Connection errored
323 *
324 * We were signalled by the event loop that a fatal error occurred on this connection.
325 *
326 * @param[in] el The event list signalling.
327 * @param[in] fd that errored.
328 * @param[in] flags El flags.
329 * @param[in] fd_errno The nature of the error.
330 * @param[in] uctx The trunk connection handle (tconn).
331 */
332static void conn_init_error(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, void *uctx)
333{
334 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
335 bio_handle_t *h;
336
337 /*
338 * Connection must be in the connecting state when this fires
339 */
340 fr_assert(conn->state == CONNECTION_STATE_CONNECTING);
341
342 h = talloc_get_type_abort(conn->h, bio_handle_t);
343
344 ERROR("%s - Connection %s failed: %s", h->ctx.module_name, h->ctx.fd_info->name, fr_syserror(fd_errno));
345
346 connection_signal_reconnect(conn, CONNECTION_FAILED);
347}
348
349/** Status check timer when opening the connection for the first time.
350 *
351 * Setup retries, or fail the connection.
352 */
353static void conn_init_timeout(fr_event_list_t *el, fr_time_t now, void *uctx)
354{
355 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
356 bio_handle_t *h;
357 bio_request_t *u;
358
359 /*
360 * Connection must be in the connecting state when this fires
361 */
362 fr_assert(conn->state == CONNECTION_STATE_CONNECTING);
363
364 h = talloc_get_type_abort(conn->h, bio_handle_t);
365 u = h->status_u;
366
367 /*
368 * We're only interested in contiguous, good, replies.
369 */
370 u->num_replies = 0;
371
372 switch (fr_retry_next(&u->retry, now)) {
373 case FR_RETRY_MRD:
374 DEBUG("%s - Reached maximum_retransmit_duration (%pVs > %pVs), failing status checks",
375 h->ctx.module_name, fr_box_time_delta(fr_time_sub(now, u->retry.start)),
376 fr_box_time_delta(u->retry.config->mrd));
377 goto fail;
378
379 case FR_RETRY_MRC:
380 DEBUG("%s - Reached maximum_retransmit_count (%u > %u), failing status checks",
381 h->ctx.module_name, u->retry.count, u->retry.config->mrc);
382 fail:
383 connection_signal_reconnect(conn, CONNECTION_FAILED);
384 return;
385
386 case FR_RETRY_CONTINUE:
387 if (fr_event_fd_insert(h, NULL, el, h->fd, conn_init_writable, NULL,
388 conn_init_error, conn) < 0) {
389 PERROR("%s - Failed inserting FD event", h->ctx.module_name);
390 connection_signal_reconnect(conn, CONNECTION_FAILED);
391 }
392 return;
393 }
394
395 fr_assert(0);
396}
397
398/** Perform the next step of init and negotiation.
399 *
400 */
401static void conn_init_next(fr_event_list_t *el, UNUSED fr_time_t now, void *uctx)
402{
403 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
404 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
405
406 if (fr_event_fd_insert(h, NULL, el, h->fd, conn_init_writable, NULL, conn_init_error, conn) < 0) {
407 PERROR("%s - Failed inserting FD event", h->ctx.module_name);
408 connection_signal_reconnect(conn, CONNECTION_FAILED);
409 }
410}
411
412/** Read the connection during the init and negotiation stage.
413 *
414 */
415static void conn_init_readable(fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
416{
417 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
418 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
419 trunk_t *trunk = h->ctx.trunk;
420 rlm_radius_t const *inst = h->ctx.inst;
421 bio_request_t *u = h->status_u;
422 ssize_t slen;
423 fr_pair_list_t reply;
424 uint8_t code = 0;
425
426 fr_pair_list_init(&reply);
427 slen = fr_bio_read(h->bio.read, NULL, h->buffer, h->buflen);
428 if (slen == 0) {
429 /*
430 * @todo - set BIO FD EOF callback, so that we don't have to check it here.
431 */
432 if (h->ctx.fd_info->eof) goto failed;
433 return;
434 }
435
436 /*
437 * We're done reading, return.
438 */
439 if (slen == fr_bio_error(IO_WOULD_BLOCK)) return;
440
441 if (slen < 0) {
442 switch (errno) {
443 case ECONNREFUSED:
444 ERROR("%s - Failed reading response from socket: there is no server listening on outgoing connection %s",
445 h->ctx.module_name, h->ctx.fd_info->name);
446 break;
447
448 default:
449 ERROR("%s - Failed reading response from socket: %s",
450 h->ctx.module_name, fr_syserror(errno));
451 break;
452 }
453
454 failed:
455 connection_signal_reconnect(conn, CONNECTION_FAILED);
456 return;
457 }
458
459 /*
460 * Where we just return in this function, we're letting
461 * the response timer take care of progressing the
462 * connection attempt.
463 */
464 if (slen < RADIUS_HEADER_LENGTH) {
465 ERROR("%s - Packet too short, expected at least %zu bytes got %zd bytes",
466 h->ctx.module_name, (size_t)RADIUS_HEADER_LENGTH, slen);
467 return;
468 }
469
470 if (u->id != h->buffer[1]) {
471 ERROR("%s - Received response with incorrect or expired ID. Expected %u, got %u",
472 h->ctx.module_name, u->id, h->buffer[1]);
473 return;
474 }
475
476 if (!check(h, &slen)) return;
477
478 if (decode(h, &reply, &code,
479 h, h->status_request, h->status_u, u->packet + RADIUS_AUTH_VECTOR_OFFSET,
480 h->buffer, slen) != DECODE_FAIL_NONE) return;
481
482 fr_pair_list_free(&reply); /* FIXME - Do something with these... */
483
484 /*
485 * Process the error, and count this as a success.
486 * This is usually used for dynamic configuration
487 * on startup.
488 */
489 if (code == FR_RADIUS_CODE_PROTOCOL_ERROR) protocol_error_reply(u, h);
490
491 /*
492 * Last trunk event was a failure, be more careful about
493 * bringing up the connection (require multiple responses).
494 */
495 if ((fr_time_gt(trunk->last_failed, fr_time_wrap(0)) && (fr_time_gt(trunk->last_failed, trunk->last_connected))) &&
496 (u->num_replies < inst->num_answers_to_alive)) {
497 /*
498 * Leave the timer in place. This timer is BOTH when we
499 * give up on the current status check, AND when we send
500 * the next status check.
501 */
502 DEBUG("%s - Received %u / %u replies for status check, on connection - %s",
503 h->ctx.module_name, u->num_replies, inst->num_answers_to_alive, h->ctx.fd_info->name);
504 DEBUG("%s - Next status check packet will be in %pVs",
505 h->ctx.module_name, fr_box_time_delta(fr_time_sub(u->retry.next, fr_time())));
506
507 /*
508 * Set the timer for the next retransmit.
509 */
510 if (fr_event_timer_at(h, el, &u->ev, u->retry.next, conn_init_next, conn) < 0) {
511 connection_signal_reconnect(conn, CONNECTION_FAILED);
512 }
513 return;
514 }
515
516 /*
517 * It's alive!
518 */
519 status_check_reset(h, u);
520
521 DEBUG("%s - Connection open - %s", h->ctx.module_name, h->ctx.fd_info->name);
522
523 connection_signal_connected(conn);
524}
525
526/** Send initial negotiation.
527 *
528 */
529static void conn_init_writable(fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
530{
531 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
532 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
533 bio_request_t *u = h->status_u;
534 ssize_t slen;
535
536 if (fr_time_eq(u->retry.start, fr_time_wrap(0))) {
537 u->id = fr_rand() & 0xff; /* We don't care what the value is here */
538 h->status_checking = true; /* Ensure this is valid */
539 fr_retry_init(&u->retry, fr_time(), &h->ctx.inst->retry[u->code]);
540
541 /*
542 * Status checks can never be retransmitted
543 * So increment the ID here.
544 */
545 } else {
546 bio_request_reset(u);
547 u->id++;
548 }
549
550 DEBUG("%s - Sending %s ID %d over connection %s",
551 h->ctx.module_name, fr_radius_packet_name[u->code], u->id, h->ctx.fd_info->name);
552
553 if (encode(h, h->status_request, u, u->id) < 0) {
554 fail:
555 connection_signal_reconnect(conn, CONNECTION_FAILED);
556 return;
557 }
558 DEBUG3("Encoded packet");
559 HEXDUMP3(u->packet, u->packet_len, NULL);
560
561 slen = fr_bio_write(h->bio.write, NULL, u->packet, u->packet_len);
562
563 if (slen == fr_bio_error(IO_WOULD_BLOCK)) goto blocked;
564
565 if (slen < 0) {
566 ERROR("%s - Failed sending %s ID %d length %zu over connection %s: %s",
567 h->ctx.module_name, fr_radius_packet_name[u->code], u->id, u->packet_len, h->ctx.fd_info->name, fr_syserror(errno));
568
569
570 goto fail;
571 }
572
573 /*
574 * @todo - handle partial packets and blocked writes.
575 */
576 if ((size_t)slen < u->packet_len) {
577 blocked:
578 ERROR("%s - Failed sending %s ID %d length %zu over connection %s: writing is blocked",
579 h->ctx.module_name, fr_radius_packet_name[u->code], u->id, u->packet_len, h->ctx.fd_info->name);
580 goto fail;
581 }
582
583 /*
584 * Switch to waiting on read and insert the event
585 * for the response timeout.
586 */
587 if (fr_event_fd_insert(h, NULL, conn->el, h->fd, conn_init_readable, NULL, conn_init_error, conn) < 0) {
588 PERROR("%s - Failed inserting FD event", h->ctx.module_name);
589 goto fail;
590 }
591
592 DEBUG("%s - %s request. Expecting response within %pVs",
593 h->ctx.module_name, (u->retry.count == 1) ? "Originated" : "Retransmitted",
594 fr_box_time_delta(u->retry.rt));
595
596 if (fr_event_timer_at(h, el, &u->ev, u->retry.next, conn_init_timeout, conn) < 0) {
597 PERROR("%s - Failed inserting timer event", h->ctx.module_name);
598 goto fail;
599 }
600
601 /*
602 * Save a copy of the header + Authentication Vector for checking the response.
603 */
604 MEM(u->packet = talloc_memdup(u, u->packet, RADIUS_HEADER_LENGTH));
605}
606
607/** Free a connection handle, closing associated resources
608 *
609 */
610static int _bio_handle_free(bio_handle_t *h)
611{
612 fr_assert(h != NULL);
613
614 fr_assert(h->fd >= 0);
615
616 if (h->status_u) fr_event_timer_delete(&h->status_u->ev);
617
618 /*
619 * The connection code will take care of deleting the FD from the event loop.
620 */
621
622 DEBUG("%s - Connection closed - %s", h->ctx.module_name, h->ctx.fd_info->name);
623
624 return 0;
625}
626
627static void bio_connected(fr_bio_t *bio)
628{
629 bio_handle_t *h = bio->uctx;
630
631 DEBUG("%s - Connection open - %s", h->ctx.module_name, h->ctx.fd_info->name);
632
633 connection_signal_connected(h->conn);
634}
635
636static void bio_error(fr_bio_t *bio)
637{
638 bio_handle_t *h = bio->uctx;
639
640 DEBUG("%s - Connection failed - %s - %s", h->ctx.module_name, h->ctx.fd_info->name,
641 fr_syserror(h->ctx.fd_info->connect_errno));
642
643 connection_signal_reconnect(h->conn, CONNECTION_FAILED);
644}
645
646static fr_bio_verify_action_t rlm_radius_verify(UNUSED fr_bio_t *bio, void *verify_ctx, UNUSED void *packet_ctx, const void *data, size_t *size)
647{
648 fr_radius_decode_fail_t failure;
649 size_t in_buffer = *size;
650 bio_handle_t *h = verify_ctx;
651 uint8_t const *hdr = data;
652 size_t want;
653
654 if (in_buffer < 20) {
655 *size = RADIUS_HEADER_LENGTH;
656 return FR_BIO_VERIFY_WANT_MORE;
657 }
658
659 /*
660 * Packet is too large, discard it.
661 */
662 want = fr_nbo_to_uint16(hdr + 2);
663 if (want > h->ctx.inst->max_packet_size) {
664 ERROR("%s - Connection %s received too long packet", h->ctx.module_name, h->ctx.fd_info->name);
665 return FR_BIO_VERIFY_ERROR_CLOSE;
666 }
667
668 /*
669 * Not a full packet, we want more data.
670 */
671 if (want < *size) {
672 *size = want;
673 return FR_BIO_VERIFY_WANT_MORE;
674 }
675
676#define REQUIRE_MA(_h) (((_h)->ctx.inst->require_message_authenticator == FR_RADIUS_REQUIRE_MA_YES) || (_h)->ctx.inst->received_message_authenticator)
677
678 /*
679 * See if we need to discard the packet.
680 */
681 if (!fr_radius_ok(data, size, h->ctx.inst->max_attributes, REQUIRE_MA(h), &failure)) {
682 if (failure == DECODE_FAIL_UNKNOWN_PACKET_CODE) return FR_BIO_VERIFY_DISCARD;
683
684 PERROR("%s - Connection %s received bad packet", h->ctx.module_name, h->ctx.fd_info->name);
685
686 return FR_BIO_VERIFY_ERROR_CLOSE;
687 }
688
689 /*
690 * @todo - check if the reply is allowed. Bad replies are discarded later, but it might be worth
691 * checking them here.
692 */
693
694 /*
695 * On input, *size is how much data we have. On output, *size is how much data we want.
696 */
697 return (in_buffer >= *size) ? FR_BIO_VERIFY_OK : FR_BIO_VERIFY_WANT_MORE;
698}
699
700
701/** Initialise a new outbound connection
702 *
703 * @param[out] h_out Where to write the new file descriptor.
704 * @param[in] conn to initialise.
705 * @param[in] uctx A #bio_thread_t
706 */
707CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
708static connection_state_t conn_init(void **h_out, connection_t *conn, void *uctx)
709{
710 int fd;
711 bio_handle_t *h;
712 bio_handle_ctx_t *ctx = uctx; /* thread or home server */
713
714 MEM(h = talloc_zero(conn, bio_handle_t));
715 h->ctx = *ctx;
716 h->conn = conn;
717 h->max_packet_size = h->ctx.inst->max_packet_size;
718 h->last_idle = fr_time();
719
720 MEM(h->buffer = talloc_array(h, uint8_t, h->max_packet_size));
721 h->buflen = h->max_packet_size;
722
723 MEM(h->tt = radius_track_alloc(h));
724
725 h->bio.fd = fr_bio_fd_alloc(h, &h->ctx.fd_config, 0);
726 if (!h->bio.fd) {
727 PERROR("%s - failed opening socket", h->ctx.module_name);
728 fail:
729 talloc_free(h);
730 return CONNECTION_STATE_FAILED;
731 }
732
733 h->bio.fd->uctx = h;
734 h->ctx.fd_info = fr_bio_fd_info(h->bio.fd);
735
736 fd = h->ctx.fd_info->socket.fd;
737 fr_assert(fd >= 0);
738
739 /*
740 * We normally read and write to the FD BIO.
741 */
742 h->bio.read = h->bio.write = h->bio.fd;
743
744 /*
745 * Create a memory BIO for stream sockets. We want to return only complete packets, and not
746 * partial packets.
747 *
748 * @todo - maybe we want to have a fr_bio_verify_t which is independent of fr_bio_mem_t. That
749 * way we don't need a memory BIO for UDP sockets, but we can still add a verification layer for
750 * UDP sockets?
751 */
752 if (h->ctx.fd_config.socket_type == SOCK_STREAM) {
753 h->bio.mem = fr_bio_mem_alloc(h, 8192, 0, h->bio.fd);
754 if (!h->bio.mem) {
755 PERROR("%s - Failed allocating memory buffer - ", h->ctx.module_name);
756 goto fail;
757 }
758
759 if (fr_bio_mem_set_verify(h->bio.mem, rlm_radius_verify, h, false) < 0) {
760 PERROR("%s - Failed setting validation callback - ", h->ctx.module_name);
761 goto fail;
762 }
763
764 /*
765 * For stream sockets, we read into the memory buffer, and then return only one packet at
766 * a time.
767 */
768 h->bio.read = h->bio.mem;
769 h->bio.mem->uctx = h;
770 }
771
772 h->fd = fd;
773
774 talloc_set_destructor(h, _bio_handle_free);
775
776 /*
777 * If the socket isn't connected, then do that first.
778 */
779 if (h->ctx.fd_info->state != FR_BIO_FD_STATE_OPEN) {
780 int rcode;
781
782 fr_assert(h->ctx.fd_info->state == FR_BIO_FD_STATE_CONNECTING);
783
784 /*
785 * We don't pass timeouts here because the trunk has it's own connection timeouts.
786 */
787 rcode = fr_bio_fd_connect_full(h->bio.fd, conn->el, bio_connected, bio_error, NULL, NULL);
788 if (rcode < 0) goto fail;
789
790 *h_out = h;
791
792 if (rcode == 0) return CONNECTION_STATE_CONNECTING;
793
794 fr_assert(rcode == 1);
795 return CONNECTION_STATE_CONNECTED;
796
797 /*
798 * If we're doing status checks, then we want at least
799 * one positive response before signalling that the
800 * connection is open.
801 *
802 * To do this we install special I/O handlers that
803 * only signal the connection as open once we get a
804 * status-check response.
805 */
806 } if (h->ctx.inst->status_check) {
807 status_check_alloc(h);
808
809 /*
810 * Start status checking.
811 *
812 * If we've had no recent failures we need exactly
813 * one response to bring the connection online,
814 * otherwise we need inst->num_answers_to_alive
815 */
816 if (fr_event_fd_insert(h, NULL, conn->el, h->fd, NULL,
817 conn_init_writable, conn_init_error, conn) < 0) goto fail;
818
819 /*
820 * If we're not doing status-checks, signal the connection
821 * as open as soon as it becomes writable.
822 */
823 } else {
824 connection_signal_on_fd(conn, fd);
825 }
826
827 *h_out = h;
828
829 return CONNECTION_STATE_CONNECTING;
830}
831
832/** Shutdown/close a file descriptor
833 *
834 */
835static void conn_close(UNUSED fr_event_list_t *el, void *handle, UNUSED void *uctx)
836{
837 bio_handle_t *h = talloc_get_type_abort(handle, bio_handle_t);
838
839 /*
840 * There's tracking entries still allocated
841 * this is bad, they should have all been
842 * released.
843 */
844 if (h->tt && (h->tt->num_requests != 0)) {
845#ifndef NDEBUG
846 radius_track_state_log(&default_log, L_ERR, __FILE__, __LINE__, h->tt, bio_tracking_entry_log);
847#endif
848 fr_assert_fail("%u tracking entries still allocated at conn close", h->tt->num_requests);
849 }
850
851 DEBUG4("Freeing handle %p", handle);
852
853 talloc_free(h);
854}
855
856/** Connection failed
857 *
858 * @param[in] handle of connection that failed.
859 * @param[in] state the connection was in when it failed.
860 * @param[in] uctx UNUSED.
861 */
862static connection_state_t conn_failed(void *handle, connection_state_t state, UNUSED void *uctx)
863{
864 switch (state) {
865 /*
866 * If the connection was connected when it failed,
867 * we need to handle any outstanding packets and
868 * timer events before reconnecting.
869 */
870 case CONNECTION_STATE_CONNECTED:
871 {
872 bio_handle_t *h = talloc_get_type_abort(handle, bio_handle_t); /* h only available if connected */
873
874 /*
875 * Reset the Status-Server checks.
876 */
877 if (h->status_u && h->status_u->ev) (void) fr_event_timer_delete(&h->status_u->ev);
878 }
879 break;
880
881 default:
882 break;
883 }
884
885 return CONNECTION_STATE_INIT;
886}
887
888CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
889static connection_t *thread_conn_alloc(trunk_connection_t *tconn, fr_event_list_t *el,
890 connection_conf_t const *conf,
891 char const *log_prefix, void *uctx)
892{
893 connection_t *conn;
894 bio_handle_ctx_t *ctx = uctx; /* thread or home server */
895
896 conn = connection_alloc(tconn, el,
897 &(connection_funcs_t){
898 .init = conn_init,
899 .close = conn_close,
900 .failed = conn_failed
901 },
902 conf,
903 log_prefix,
904 uctx);
905 if (!conn) {
906 PERROR("%s - Failed allocating state handler for new connection", ctx->inst->name);
907 return NULL;
908 }
909 ctx->trunk = tconn->trunk;
910 ctx->module_name = log_prefix;
911
912 return conn;
913}
914
915/** Read and discard data
916 *
917 */
918static void conn_discard(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
919{
920 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
921 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
922 uint8_t buffer[4096];
923 ssize_t slen;
924
925 while ((slen = fr_bio_read(h->bio.read, NULL, buffer, sizeof(buffer))) > 0);
926
927 if (slen < 0) {
928 switch (errno) {
929 case EBADF:
930 case ECONNRESET:
931 case ENOTCONN:
932 case ETIMEDOUT:
933 ERROR("%s - Failed draining socket: %s", h->ctx.module_name, fr_syserror(errno));
934 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
935 break;
936
937 default:
938 break;
939 }
940 }
941}
942
943/** Connection errored
944 *
945 * We were signalled by the event loop that a fatal error occurred on this connection.
946 *
947 * @param[in] el The event list signalling.
948 * @param[in] fd that errored.
949 * @param[in] flags El flags.
950 * @param[in] fd_errno The nature of the error.
951 * @param[in] uctx The trunk connection handle (tconn).
952 */
953static void conn_error(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, void *uctx)
954{
955 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
956 connection_t *conn = tconn->conn;
957 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
958
959 ERROR("%s - Connection %s failed: %s", h->ctx.module_name, h->ctx.fd_info->name, fr_syserror(fd_errno));
960
961 connection_signal_reconnect(conn, CONNECTION_FAILED);
962}
963
964CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
965static void thread_conn_notify(trunk_connection_t *tconn, connection_t *conn,
966 fr_event_list_t *el,
967 trunk_connection_event_t notify_on, UNUSED void *uctx)
968{
969 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
970 fr_event_fd_cb_t read_fn = NULL;
971 fr_event_fd_cb_t write_fn = NULL;
972
973 switch (notify_on) {
974 /*
975 * We may have sent multiple requests to the
976 * other end, so it might be sending us multiple
977 * replies. We want to drain the socket, instead
978 * of letting the packets sit in the UDP receive
979 * queue.
980 */
981 case TRUNK_CONN_EVENT_NONE:
982 read_fn = conn_discard;
983 break;
984
985 case TRUNK_CONN_EVENT_READ:
986 read_fn = trunk_connection_callback_readable;
987 break;
988
989 case TRUNK_CONN_EVENT_WRITE:
990 write_fn = trunk_connection_callback_writable;
991 break;
992
993 case TRUNK_CONN_EVENT_BOTH:
994 read_fn = trunk_connection_callback_readable;
995 write_fn = trunk_connection_callback_writable;
996 break;
997
998 }
999
1000 /*
1001 * Over-ride read for replication.
1002 */
1003 if (h->ctx.inst->mode == RLM_RADIUS_MODE_REPLICATE) {
1004 read_fn = conn_discard;
1005
1006 if (fr_bio_fd_write_only(h->bio.fd) < 0) {
1007 PERROR("%s - Failed setting socket to write-only", h->ctx.module_name);
1008 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1009 return;
1010 }
1011 }
1012
1013 if (fr_event_fd_insert(h, NULL, el, h->fd,
1014 read_fn,
1015 write_fn,
1016 conn_error,
1017 tconn) < 0) {
1018 PERROR("%s - Failed inserting FD event", h->ctx.module_name);
1019
1020 /*
1021 * May free the connection!
1022 */
1023 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1024 }
1025}
1026
1027/*
1028 * Return negative numbers to put 'a' at the top of the heap.
1029 * Return positive numbers to put 'b' at the top of the heap.
1030 *
1031 * We want the value with the lowest timestamp to be prioritized at
1032 * the top of the heap.
1033 */
1034static int8_t request_prioritise(void const *one, void const *two)
1035{
1036 bio_request_t const *a = one;
1037 bio_request_t const *b = two;
1038 int8_t ret;
1039
1040 /*
1041 * Prioritise status check packets
1042 */
1043 ret = (b->status_check - a->status_check);
1044 if (ret != 0) return ret;
1045
1046 /*
1047 * Larger priority is more important.
1048 */
1049 ret = CMP(a->priority, b->priority);
1050 if (ret != 0) return ret;
1051
1052 /*
1053 * Smaller timestamp (i.e. earlier) is more important.
1054 */
1055 return CMP_PREFER_SMALLER(fr_time_unwrap(a->recv_time), fr_time_unwrap(b->recv_time));
1056}
1057
1058/** Decode response packet data, extracting relevant information and validating the packet
1059 *
1060 * @param[in] ctx to allocate pairs in.
1061 * @param[out] reply Pointer to head of pair list to add reply attributes to.
1062 * @param[out] response_code The type of response packet.
1063 * @param[in] h connection handle.
1064 * @param[in] request the request.
1065 * @param[in] u UDP request.
1066 * @param[in] request_authenticator from the original request.
1067 * @param[in] data to decode.
1068 * @param[in] data_len Length of input data.
1069 * @return
1070 * - DECODE_FAIL_NONE on success.
1071 * - DECODE_FAIL_* on failure.
1072 */
1073static fr_radius_decode_fail_t decode(TALLOC_CTX *ctx, fr_pair_list_t *reply, uint8_t *response_code,
1074 bio_handle_t *h, request_t *request, bio_request_t *u,
1075 uint8_t const request_authenticator[static RADIUS_AUTH_VECTOR_LENGTH],
1076 uint8_t *data, size_t data_len)
1077{
1078 rlm_radius_t const *inst = talloc_get_type_abort_const(h->ctx.inst, rlm_radius_t);
1079 uint8_t code;
1080 fr_radius_decode_ctx_t decode_ctx;
1081
1082 *response_code = 0; /* Initialise to keep the rest of the code happy */
1083
1084 RHEXDUMP3(data, data_len, "Read packet");
1085
1086 decode_ctx = (fr_radius_decode_ctx_t) {
1087 .common = &h->ctx.radius_ctx,
1088 .request_code = u->code,
1089 .request_authenticator = request_authenticator,
1090 .tmp_ctx = talloc(ctx, uint8_t),
1091 .end = data + data_len,
1092 .verify = true,
1093 .require_message_authenticator = REQUIRE_MA(h),
1094 };
1095
1096 if (fr_radius_decode(ctx, reply, data, data_len, &decode_ctx) < 0) {
1097 talloc_free(decode_ctx.tmp_ctx);
1098 RPEDEBUG("Failed reading packet");
1099 return DECODE_FAIL_UNKNOWN;
1100 }
1101 talloc_free(decode_ctx.tmp_ctx);
1102
1103 code = data[0];
1104
1105 RDEBUG("Received %s ID %d length %zu reply packet on connection %s",
1106 fr_radius_packet_name[code], data[1], data_len, h->ctx.fd_info->name);
1107 log_request_pair_list(L_DBG_LVL_2, request, NULL, reply, NULL);
1108
1109 /*
1110 * This code is for BlastRADIUS mitigation.
1111 *
1112 * The scenario where this applies is where we send Message-Authenticator
1113 * but the home server doesn't support it or require it, in which case
1114 * the response can be manipulated by an attacker.
1115 */
1116 if ((u->code == FR_RADIUS_CODE_ACCESS_REQUEST) &&
1117 (inst->require_message_authenticator == FR_RADIUS_REQUIRE_MA_AUTO) &&
1118 !*(inst->received_message_authenticator) &&
1119 fr_pair_find_by_da(&request->request_pairs, NULL, attr_message_authenticator) &&
1120 !fr_pair_find_by_da(&request->request_pairs, NULL, attr_eap_message)) {
1121 RINFO("Packet contained a valid Message-Authenticator. Setting \"require_message_authenticator = yes\"");
1122 *(inst->received_message_authenticator) = true;
1123 }
1124
1125 *response_code = code;
1126
1127 /*
1128 * Record the fact we've seen a response
1129 */
1130 u->num_replies++;
1131
1132 /*
1133 * Fixup retry times
1134 */
1135 if (fr_time_gt(u->retry.start, h->mrs_time)) h->mrs_time = u->retry.start;
1136
1137 return DECODE_FAIL_NONE;
1138}
1139
1140static int encode(bio_handle_t *h, request_t *request, bio_request_t *u, uint8_t id)
1141{
1142 ssize_t packet_len;
1143 fr_radius_encode_ctx_t encode_ctx;
1144 rlm_radius_t const *inst = h->ctx.inst;
1145
1146 fr_assert(inst->allowed[u->code]);
1147 fr_assert(!u->packet);
1148
1149 u->packet_len = inst->max_packet_size;
1150 u->packet = h->buffer;
1151
1152 /*
1153 * We should have at minimum 64-byte packets, so don't
1154 * bother doing run-time checks here.
1155 */
1156 fr_assert(u->packet_len >= (size_t) RADIUS_HEADER_LENGTH);
1157
1158 encode_ctx = (fr_radius_encode_ctx_t) {
1159 .common = &h->ctx.radius_ctx,
1160 .rand_ctx = (fr_fast_rand_t) {
1161 .a = fr_rand(),
1162 .b = fr_rand(),
1163 },
1164 .code = u->code,
1165 .id = id,
1166 .add_proxy_state = u->proxied,
1167 };
1168
1169 /*
1170 * If we're sending a status check packet, update any
1171 * necessary timestamps. Also, don't add Proxy-State, as
1172 * we're originating the packet.
1173 */
1174 if (u->status_check) {
1175 fr_pair_t *vp;
1176
1177 vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_event_timestamp);
1178 if (vp) vp->vp_date = fr_time_to_unix_time(u->retry.updated);
1179
1180 encode_ctx.add_proxy_state = false;
1181 }
1182
1183 /*
1184 * Encode it, leaving room for Proxy-State if necessary.
1185 */
1186 packet_len = fr_radius_encode(&FR_DBUFF_TMP(u->packet, u->packet_len),
1187 &request->request_pairs, &encode_ctx);
1188 if (fr_pair_encode_is_error(packet_len)) {
1189 RPERROR("Failed encoding packet");
1190
1191 error:
1192 TALLOC_FREE(u->packet);
1193 return -1;
1194 }
1195
1196 if (packet_len < 0) {
1197 size_t have;
1198 size_t need;
1199
1200 have = u->packet_len;
1201 need = have - packet_len;
1202
1203 if (need > RADIUS_MAX_PACKET_SIZE) {
1204 RERROR("Failed encoding packet. Have %zu bytes of buffer, need %zu bytes",
1205 have, need);
1206 } else {
1207 RERROR("Failed encoding packet. Have %zu bytes of buffer, need %zu bytes. "
1208 "Increase 'max_packet_size'", have, need);
1209 }
1210
1211 goto error;
1212 }
1213 /*
1214 * The encoded packet should NOT over-run the input buffer.
1215 */
1216 fr_assert((size_t) packet_len <= u->packet_len);
1217
1218 /*
1219 * Add Proxy-State to the tail end of the packet.
1220 *
1221 * We need to add it here, and NOT in
1222 * request->request_pairs, because multiple modules
1223 * may be sending the packets at the same time.
1224 */
1225 if (encode_ctx.add_proxy_state) {
1226 fr_pair_t *vp;
1227
1228 MEM(vp = fr_pair_afrom_da(u, attr_proxy_state));
1229 fr_pair_value_memdup(vp, (uint8_t const *) &inst->common_ctx.proxy_state, sizeof(inst->common_ctx.proxy_state), false);
1230 fr_pair_append(&u->extra, vp);
1231 packet_len += 2 + sizeof(inst->common_ctx.proxy_state);
1232 }
1233
1234 /*
1235 * Update our version of the packet length.
1236 */
1237 u->packet_len = packet_len;
1238
1239 /*
1240 * Now that we're done mangling the packet, sign it.
1241 */
1242 if (fr_radius_sign(u->packet, NULL, (uint8_t const *) h->ctx.radius_ctx.secret,
1243 h->ctx.radius_ctx.secret_length) < 0) {
1244 RERROR("Failed signing packet");
1245 goto error;
1246 }
1247
1248 return 0;
1249}
1250
1251
1252/** Revive a connection after "revive_interval"
1253 *
1254 */
1255static void revive_timeout(UNUSED fr_event_list_t *el, UNUSED fr_time_t now, void *uctx)
1256{
1257 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
1258 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1259
1260 INFO("%s - Reviving connection %s", h->ctx.module_name, h->ctx.fd_info->name);
1261 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1262}
1263
1264/** Mark a connection dead after "zombie_interval"
1265 *
1266 */
1267static void zombie_timeout(fr_event_list_t *el, fr_time_t now, void *uctx)
1268{
1269 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
1270 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1271
1272 INFO("%s - No replies during 'zombie_period', marking connection %s as dead", h->ctx.module_name, h->ctx.fd_info->name);
1273
1274 /*
1275 * Don't use this connection, and re-queue all of its
1276 * requests onto other connections.
1277 */
1278 (void) trunk_connection_requests_requeue(tconn, TRUNK_REQUEST_STATE_ALL, 0, false);
1279
1280 /*
1281 * We do have status checks. Try to reconnect the
1282 * connection immediately. If the status checks pass,
1283 * then the connection will be marked "alive"
1284 */
1285 if (h->ctx.inst->status_check) {
1286 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1287 return;
1288 }
1289
1290 /*
1291 * Revive the connection after a time.
1292 */
1293 if (fr_event_timer_at(h, el, &h->zombie_ev,
1294 fr_time_add(now, h->ctx.inst->revive_interval), revive_timeout, tconn) < 0) {
1295 ERROR("Failed inserting revive timeout for connection");
1296 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1297 }
1298}
1299
1300
1301/** See if the connection is zombied.
1302 *
1303 * We check for zombie when major events happen:
1304 *
1305 * 1) request hits its final timeout
1306 * 2) request timer hits, and it needs to be retransmitted
1307 * 3) a DUP packet comes in, and the request needs to be retransmitted
1308 * 4) we're sending a packet.
1309 *
1310 * There MIGHT not be retries configured, so we MUST check for zombie
1311 * when any new packet comes in. Similarly, there MIGHT not be new
1312 * packets, but retries are configured, so we have to check there,
1313 * too.
1314 *
1315 * Also, the socket might not be writable for a while. There MIGHT
1316 * be a long time between getting the timer / DUP signal, and the
1317 * request finally being written to the socket. So we need to check
1318 * for zombie at BOTH the timeout and the mux / write function.
1319 *
1320 * @return
1321 * - true if the connection is zombie.
1322 * - false if the connection is not zombie.
1323 */
1324static bool check_for_zombie(fr_event_list_t *el, trunk_connection_t *tconn, fr_time_t now, fr_time_t last_sent)
1325{
1326 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1327
1328 /*
1329 * We're replicating, and don't care about the health of
1330 * the home server, and this function should not be called.
1331 */
1332 fr_assert(h->ctx.inst->mode != RLM_RADIUS_MODE_REPLICATE);
1333
1334 /*
1335 * If we're status checking OR already zombie, don't go to zombie
1336 */
1337 if (h->status_checking || h->zombie_ev) return true;
1338
1339 if (fr_time_eq(now, fr_time_wrap(0))) now = fr_time();
1340
1341 /*
1342 * We received a reply since this packet was sent, the connection isn't zombie.
1343 */
1344 if (fr_time_gteq(h->last_reply, last_sent)) return false;
1345
1346 /*
1347 * If we've seen ANY response in the allowed window, then the connection is still alive.
1348 */
1349 if ((h->ctx.inst->mode == RLM_RADIUS_MODE_PROXY) && fr_time_gt(last_sent, fr_time_wrap(0)) &&
1350 (fr_time_lt(fr_time_add(last_sent, h->ctx.inst->response_window), now))) return false;
1351
1352 /*
1353 * Stop using it for new requests.
1354 */
1355 WARN("%s - Entering Zombie state - connection %s", h->ctx.module_name, h->ctx.fd_info->name);
1356 trunk_connection_signal_inactive(tconn);
1357
1358 if (h->ctx.inst->status_check) {
1359 h->status_checking = true;
1360
1361 /*
1362 * Queue up the status check packet. It will be sent
1363 * when the connection is writable.
1364 */
1365 h->status_u->retry.start = fr_time_wrap(0);
1366 h->status_u->treq = NULL;
1367
1368 if (trunk_request_enqueue_on_conn(&h->status_u->treq, tconn, h->status_request,
1369 h->status_u, h->status_u, true) != TRUNK_ENQUEUE_OK) {
1370 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1371 }
1372 } else {
1373 if (fr_event_timer_at(h, el, &h->zombie_ev, fr_time_add(now, h->ctx.inst->zombie_period),
1374 zombie_timeout, tconn) < 0) {
1375 ERROR("Failed inserting zombie timeout for connection");
1376 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1377 }
1378 }
1379
1380 return true;
1381}
1382
1383static void mod_dup(request_t *request, bio_request_t *u)
1384{
1385 bio_handle_t *h;
1386
1387 h = talloc_get_type_abort(u->treq->tconn->conn->h, bio_handle_t);
1388
1389 if (h->ctx.fd_config.socket_type != SOCK_DGRAM) {
1390 RDEBUG("Using stream sockets - suppressing retransmission");
1391 return;
1392 }
1393
1394 /*
1395 * Arguably this should never happen for UDP sockets.
1396 */
1397 if (h->ctx.fd_info->write_blocked) {
1398 RDEBUG("IO is blocked - suppressing retransmission");
1399 return;
1400 }
1401 u->is_retry = true;
1402
1403 /*
1404 * We are doing synchronous proxying, retransmit
1405 * the current request on the same connection.
1406 *
1407 * If it's zombie, we still resend it. If the
1408 * connection is dead, then a callback will move
1409 * this request to a new connection.
1410 */
1411 mod_write(request, u->treq, h);
1412}
1413
1414static void do_retry(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_retry_t const *retry);
1415
1416/** Handle module retries.
1417 *
1418 */
1419static void mod_retry(module_ctx_t const *mctx, request_t *request, fr_retry_t const *retry)
1420{
1421 bio_request_t *u = talloc_get_type_abort(mctx->rctx, bio_request_t);
1422 rlm_radius_t const *inst = talloc_get_type_abort(mctx->mi->data, rlm_radius_t);
1423
1424 do_retry(inst, u, request, retry);
1425}
1426
1427static void do_retry(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_retry_t const *retry)
1428{
1429 trunk_request_t *treq = talloc_get_type_abort(u->treq, trunk_request_t);
1430 trunk_connection_t *tconn = treq->tconn;
1431 fr_time_t now = retry->updated;
1432
1433 fr_assert(request == treq->request);
1434 fr_assert(treq->preq); /* Must still have a protocol request */
1435 fr_assert(treq->preq == u);
1436
1437 switch (retry->state) {
1438 case FR_RETRY_CONTINUE:
1439 u->retry = *retry;
1440
1441 switch (treq->state) {
1442 case TRUNK_REQUEST_STATE_INIT:
1443 case TRUNK_REQUEST_STATE_UNASSIGNED:
1444 fr_assert(0);
1445 break;
1446
1447 case TRUNK_REQUEST_STATE_BACKLOG:
1448 RDEBUG("Packet is still in the backlog queue to be sent - suppressing retransmission");
1449 return;
1450
1451 case TRUNK_REQUEST_STATE_PENDING:
1452 RDEBUG("Packet is still in the pending queue to be sent - suppressing retransmission");
1453 return;
1454
1455 case TRUNK_REQUEST_STATE_PARTIAL:
1456 RDEBUG("Packet was partially written, as IO is blocked - suppressing retransmission");
1457 return;
1458
1459 case TRUNK_REQUEST_STATE_SENT:
1460 fr_assert(tconn);
1461
1462 mod_dup(request, u);
1463 return;
1464
1465 case TRUNK_REQUEST_STATE_REAPABLE:
1466 case TRUNK_REQUEST_STATE_COMPLETE:
1467 case TRUNK_REQUEST_STATE_FAILED:
1468 case TRUNK_REQUEST_STATE_CANCEL:
1469 case TRUNK_REQUEST_STATE_CANCEL_SENT:
1470 case TRUNK_REQUEST_STATE_CANCEL_PARTIAL:
1471 case TRUNK_REQUEST_STATE_CANCEL_COMPLETE:
1472 fr_assert(0);
1473 break;
1474 }
1475 break;
1476
1477 case FR_RETRY_MRD:
1478 REDEBUG("Reached maximum_retransmit_duration (%pVs > %pVs), failing request",
1479 fr_box_time_delta(fr_time_sub(now, retry->start)), fr_box_time_delta(retry->config->mrd));
1480 break;
1481
1482 case FR_RETRY_MRC:
1483 REDEBUG("Reached maximum_retransmit_count (%u > %u), failing request",
1484 retry->count, retry->config->mrc);
1485 break;
1486 }
1487
1488 u->rcode = RLM_MODULE_FAIL;
1489 trunk_request_signal_fail(treq);
1490
1491 /*
1492 * We don't do zombie stuff!
1493 */
1494 if (!tconn || (inst->mode == RLM_RADIUS_MODE_REPLICATE)) return;
1495
1496 check_for_zombie(unlang_interpret_event_list(request), tconn, now, retry->start);
1497}
1498
1499CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
1500static void request_mux(UNUSED fr_event_list_t *el,
1501 trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
1502{
1503 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
1504 trunk_request_t *treq;
1505 request_t *request;
1506
1507 if (unlikely(trunk_connection_pop_request(&treq, tconn) < 0)) return;
1508
1509 /*
1510 * No more requests to send
1511 */
1512 if (!treq) return;
1513
1514 request = treq->request;
1515
1516 mod_write(request, treq, h);
1517}
1518
1519static void mod_write(request_t *request, trunk_request_t *treq, bio_handle_t *h)
1520{
1521 rlm_radius_t const *inst = h->ctx.inst;
1522 bio_request_t *u;
1523 char const *action;
1524 uint8_t const *packet;
1525 size_t packet_len;
1526 ssize_t slen;
1527
1528 fr_assert((treq->state == TRUNK_REQUEST_STATE_PENDING) ||
1529 (treq->state == TRUNK_REQUEST_STATE_PARTIAL));
1530
1531 u = treq->preq;
1532
1533 fr_assert(!u->status_check);
1534
1535 /*
1536 * If it's a partial packet, then write the partial bit.
1537 */
1538 if (u->partial) {
1539 fr_assert(u->partial < u->packet_len);
1540 packet = u->packet + u->partial;
1541 packet_len = u->packet_len - u->partial;
1542 goto do_write;
1543 }
1544
1545 /*
1546 * No previous packet, OR can't retransmit the
1547 * existing one. Oh well.
1548 *
1549 * Note that if we can't retransmit the previous
1550 * packet, then u->rr MUST already have been
1551 * deleted in the request_cancel() function
1552 * or request_release_conn() function when
1553 * the REQUEUE signal was received.
1554 */
1555 if (!u->packet) {
1556 fr_assert(!u->rr);
1557
1558 if (unlikely(radius_track_entry_reserve(&u->rr, treq, h->tt, request, u->code, treq) < 0)) {
1559#ifndef NDEBUG
1560 radius_track_state_log(&default_log, L_ERR, __FILE__, __LINE__,
1561 h->tt, bio_tracking_entry_log);
1562#endif
1563 fr_assert_fail("Tracking entry allocation failed: %s", fr_strerror());
1564 trunk_request_signal_fail(treq);
1565 return;
1566 }
1567 fr_assert(u->rr);
1568 u->id = u->rr->id;
1569
1570 RDEBUG("Sending %s ID %d length %zu over connection %s",
1571 fr_radius_packet_name[u->code], u->id, u->packet_len, h->ctx.fd_info->name);
1572
1573 if (encode(h, request, u, u->id) < 0) {
1574 /*
1575 * Need to do this because request_conn_release
1576 * may not be called.
1577 */
1578 bio_request_reset(u);
1579 trunk_request_signal_fail(treq);
1580 return;
1581 }
1582 RHEXDUMP3(u->packet, u->packet_len, "Encoded packet");
1583
1584 /*
1585 * Remember the authentication vector, which now has the
1586 * packet signature.
1587 */
1588 (void) radius_track_entry_update(u->rr, u->packet + RADIUS_AUTH_VECTOR_OFFSET);
1589 } else {
1590 RDEBUG("Retransmitting %s ID %d length %zu over connection %s",
1591 fr_radius_packet_name[u->code], u->id, u->packet_len, h->ctx.fd_info->name);
1592 }
1593
1594 /*
1595 * @todo - When logging Message-Authenticator, don't print its' value.
1596 */
1597 log_request_pair_list(L_DBG_LVL_2, request, NULL, &request->request_pairs, NULL);
1598 if (!fr_pair_list_empty(&u->extra)) log_request_pair_list(L_DBG_LVL_2, request, NULL, &u->extra, NULL);
1599
1600 packet = u->packet;
1601 packet_len = u->packet_len;
1602
1603do_write:
1604 slen = fr_bio_write(h->bio.write, NULL, packet, packet_len);
1605
1606 /*
1607 * Can't write anything, requeue it on a different socket.
1608 */
1609 if (slen == fr_bio_error(IO_WOULD_BLOCK)) goto requeue;
1610
1611 if (slen < 0) {
1612 switch (errno) {
1613 /*
1614 * There is an error in the request.
1615 */
1616 case EMSGSIZE: /* Packet size exceeds max size allowed on socket */
1617 ERROR("%s - Failed sending data over connection %s: %s",
1618 h->ctx.module_name, h->ctx.fd_info->name, fr_syserror(errno));
1619 trunk_request_signal_fail(treq);
1620 break;
1621
1622 /*
1623 * There is an error in the connection. The reconnection will re-queue any pending or
1624 * sent requests, so we don't have to do any cleanup.
1625 */
1626 default:
1627 ERROR("%s - Failed sending data over connection %s: %s",
1628 h->ctx.module_name, h->ctx.fd_info->name, fr_syserror(errno));
1629 trunk_connection_signal_reconnect(treq->tconn, CONNECTION_FAILED);
1630 break;
1631 }
1632
1633 return;
1634 }
1635
1636 /*
1637 * No data to send, ignore the write for partials, but otherwise requeue it.
1638 */
1639 if (slen == 0) {
1640 if (u->partial) return;
1641
1642 requeue:
1643 RWARN("%s - Failed sending data over connection %s: sent zero bytes",
1644 h->ctx.module_name, h->ctx.fd_info->name);
1645 trunk_request_requeue(treq);
1646 return;
1647 }
1648
1649 packet_len += slen;
1650 if (packet_len < u->packet_len) {
1651 /*
1652 * The first time around, save a copy of the packet for later writing.
1653 */
1654 if (!u->partial) MEM(u->packet = talloc_memdup(u, u->packet, u->packet_len));
1655
1656 u->partial = packet_len;
1657 trunk_request_signal_partial(treq);
1658 return;
1659 }
1660
1661 /*
1662 * For retransmissions.
1663 */
1664 u->partial = 0;
1665
1666 /*
1667 * Don't print anything extra for replication.
1668 */
1669 if (inst->mode == RLM_RADIUS_MODE_REPLICATE) {
1670 u->rcode = RLM_MODULE_OK;
1671 trunk_request_signal_complete(treq);
1672 return;
1673 }
1674
1675 /*
1676 * On first packet, signal it as sent, and update stats.
1677 *
1678 * Later packets are just retransmissions to the BIO, and don't need to involve
1679 * the trunk code.
1680 */
1681 if (u->retry.count == 1) {
1682 h->last_sent = u->retry.start;
1683 if (fr_time_lteq(h->first_sent, h->last_idle)) h->first_sent = h->last_sent;
1684
1685 trunk_request_signal_sent(treq);
1686
1687 action = u->proxied ? "Proxied" : "Originated";
1688
1689 } else {
1690 /*
1691 * We don't signal the trunk that it's been sent, it was already senty
1692 */
1693 action = "Retransmitted";
1694 }
1695
1696 fr_assert(!u->status_check);
1697
1698 if (!u->proxied) {
1699 RDEBUG("%s request. Expecting response within %pVs", action,
1700 fr_box_time_delta(u->retry.rt));
1701
1702 } else {
1703 /*
1704 * If the packet doesn't get a response,
1705 * then bio_request_free() will notice, and run conn_zombie()
1706 */
1707 RDEBUG("%s request. Relying on NAS to perform more retransmissions", action);
1708 }
1709
1710 /*
1711 * We don't retransmit over TCP.
1712 */
1713 if (h->ctx.fd_config.socket_type != SOCK_DGRAM) return;
1714
1715 /*
1716 * If we only send one datagram packet, then don't bother saving it.
1717 */
1718 if (u->retry.config && u->retry.config->mrc == 1) {
1719 u->packet = NULL;
1720 return;
1721 }
1722
1723 MEM(u->packet = talloc_memdup(u, u->packet, u->packet_len));
1724}
1725
1726/** Deal with Protocol-Error replies, and possible negotiation
1727 *
1728 */
1729static void protocol_error_reply(bio_request_t *u, bio_handle_t *h)
1730{
1731 bool error_601 = false;
1732 uint32_t response_length = 0;
1733 uint8_t const *attr, *end;
1734
1735 end = h->buffer + fr_nbo_to_uint16(h->buffer + 2);
1736
1737 for (attr = h->buffer + RADIUS_HEADER_LENGTH;
1738 attr < end;
1739 attr += attr[1]) {
1740 /*
1741 * Error-Cause = Response-Too-Big
1742 */
1743 if ((attr[0] == attr_error_cause->attr) && (attr[1] == 6)) {
1744 uint32_t error;
1745
1746 memcpy(&error, attr + 2, 4);
1747 error = ntohl(error);
1748 if (error == 601) error_601 = true;
1749 continue;
1750 }
1751
1752 /*
1753 * The other end wants us to increase our Response-Length
1754 */
1755 if ((attr[0] == attr_response_length->attr) && (attr[1] == 6)) {
1756 memcpy(&response_length, attr + 2, 4);
1757 continue;
1758 }
1759
1760 /*
1761 * Protocol-Error packets MUST contain an
1762 * Original-Packet-Code attribute.
1763 *
1764 * The attribute containing the
1765 * Original-Packet-Code is an extended
1766 * attribute.
1767 */
1768 if (attr[0] != attr_extended_attribute_1->attr) continue;
1769
1770 /*
1771 * ATTR + LEN + EXT-Attr + uint32
1772 */
1773 if (attr[1] != 7) continue;
1774
1775 /*
1776 * See if there's an Original-Packet-Code.
1777 */
1778 if (attr[2] != (uint8_t)attr_original_packet_code->attr) continue;
1779
1780 /*
1781 * Has to be an 8-bit number.
1782 */
1783 if ((attr[3] != 0) ||
1784 (attr[4] != 0) ||
1785 (attr[5] != 0)) {
1786 u->rcode = RLM_MODULE_FAIL;
1787 return;
1788 }
1789
1790 /*
1791 * The value has to match. We don't
1792 * currently multiplex different codes
1793 * with the same IDs on connections. So
1794 * this check is just for RFC compliance,
1795 * and for sanity.
1796 */
1797 if (attr[6] != u->code) {
1798 u->rcode = RLM_MODULE_FAIL;
1799 return;
1800 }
1801 }
1802
1803 /*
1804 * Error-Cause = Response-Too-Big
1805 *
1806 * The other end says it needs more room to send it's response
1807 *
1808 * Limit it to reasonable values.
1809 */
1810 if (error_601 && response_length && (response_length > h->buflen)) {
1811 if (response_length < 4096) response_length = 4096;
1812 if (response_length > 65535) response_length = 65535;
1813
1814 DEBUG("%s - Increasing buffer size to %u for connection %s", h->ctx.module_name, response_length, h->ctx.fd_info->name);
1815
1816 /*
1817 * Make sure to copy the packet over!
1818 */
1819 attr = h->buffer;
1820 h->buflen = response_length;
1821 MEM(h->buffer = talloc_array(h, uint8_t, h->buflen));
1822
1823 memcpy(h->buffer, attr, end - attr);
1824 }
1825
1826 /*
1827 * fail - something went wrong internally, or with the connection.
1828 * invalid - wrong response to packet
1829 * handled - best remaining alternative :(
1830 *
1831 * i.e. if the response is NOT accept, reject, whatever,
1832 * then we shouldn't allow the caller to do any more
1833 * processing of this packet. There was a protocol
1834 * error, and the response is valid, but not useful for
1835 * anything.
1836 */
1837 u->rcode = RLM_MODULE_HANDLED;
1838}
1839
1840
1841/** Handle retries for a status check
1842 *
1843 */
1844static void status_check_next(UNUSED fr_event_list_t *el, UNUSED fr_time_t now, void *uctx)
1845{
1846 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
1847 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1848
1849 if (trunk_request_enqueue_on_conn(&h->status_u->treq, tconn, h->status_request,
1850 h->status_u, h->status_u, true) != TRUNK_ENQUEUE_OK) {
1851 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1852 }
1853}
1854
1855
1856/** Deal with replies replies to status checks and possible negotiation
1857 *
1858 */
1859static void status_check_reply(trunk_request_t *treq, fr_time_t now)
1860{
1861 bio_handle_t *h = talloc_get_type_abort(treq->tconn->conn->h, bio_handle_t);
1862 rlm_radius_t const *inst = h->ctx.inst;
1863 bio_request_t *u = talloc_get_type_abort(treq->rctx, bio_request_t);
1864
1865 fr_assert(treq->preq == h->status_u);
1866 fr_assert(treq->rctx == h->status_u);
1867
1868 u->treq = NULL;
1869
1870 /*
1871 * @todo - do other negotiation and signaling.
1872 */
1873 if (h->buffer[0] == FR_RADIUS_CODE_PROTOCOL_ERROR) protocol_error_reply(u, h);
1874
1875 if (u->num_replies < inst->num_answers_to_alive) {
1876 DEBUG("Received %u / %u replies for status check, on connection - %s",
1877 u->num_replies, inst->num_answers_to_alive, h->ctx.fd_info->name);
1878 DEBUG("Next status check packet will be in %pVs", fr_box_time_delta(fr_time_sub(u->retry.next, now)));
1879
1880 /*
1881 * Set the timer for the next retransmit.
1882 */
1883 if (fr_event_timer_at(h, h->ctx.el, &u->ev, u->retry.next, status_check_next, treq->tconn) < 0) {
1884 trunk_connection_signal_reconnect(treq->tconn, CONNECTION_FAILED);
1885 }
1886 return;
1887 }
1888
1889 DEBUG("Received enough replies to status check, marking connection as active - %s", h->ctx.fd_info->name);
1890
1891 /*
1892 * Set the "last idle" time to now, so that we don't
1893 * restart zombie_period until sufficient time has
1894 * passed.
1895 */
1896 h->last_idle = fr_time();
1897
1898 /*
1899 * Reset retry interval and retransmission counters
1900 * also frees u->ev.
1901 */
1902 status_check_reset(h, u);
1903 trunk_connection_signal_active(treq->tconn);
1904}
1905
1906CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
1907static void request_demux(UNUSED fr_event_list_t *el, trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
1908{
1909 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
1910
1911 DEBUG3("%s - Reading data for connection %s", h->ctx.module_name, h->ctx.fd_info->name);
1912
1913 while (true) {
1914 ssize_t slen;
1915
1916 trunk_request_t *treq;
1917 request_t *request;
1918 bio_request_t *u;
1919 radius_track_entry_t *rr;
1920 fr_radius_decode_fail_t reason;
1921 uint8_t code = 0;
1922 fr_pair_list_t reply;
1923 fr_pair_t *vp;
1924
1925 fr_time_t now;
1926
1927 fr_pair_list_init(&reply);
1928
1929 /*
1930 * Drain the socket of all packets. If we're busy, this
1931 * saves a round through the event loop. If we're not
1932 * busy, a few extra system calls don't matter.
1933 */
1934 slen = fr_bio_read(h->bio.read, NULL, h->buffer, h->buflen);
1935 if (slen == 0) {
1936 /*
1937 * @todo - set BIO FD EOF callback, so that we don't have to check it here.
1938 */
1939 if (h->ctx.fd_info->eof) trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1940 return;
1941 }
1942
1943 /*
1944 * We're done reading, return.
1945 */
1946 if (slen == fr_bio_error(IO_WOULD_BLOCK)) return;
1947
1948 if (slen < 0) {
1949 ERROR("%s - Failed reading response from socket: %s",
1950 h->ctx.module_name, fr_syserror(errno));
1951 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1952 return;
1953 }
1954
1955 if (slen < RADIUS_HEADER_LENGTH) {
1956 ERROR("%s - Packet too short, expected at least %zu bytes got %zd bytes",
1957 h->ctx.module_name, (size_t)RADIUS_HEADER_LENGTH, slen);
1958 continue;
1959 }
1960
1961 /*
1962 * Note that we don't care about packet codes. All
1963 * packet codes share the same ID space.
1964 */
1965 rr = radius_track_entry_find(h->tt, h->buffer[1], NULL);
1966 if (!rr) {
1967 WARN("%s - Ignoring reply with ID %i that arrived too late",
1968 h->ctx.module_name, h->buffer[1]);
1969 continue;
1970 }
1971
1972 treq = talloc_get_type_abort(rr->uctx, trunk_request_t);
1973 request = treq->request;
1974 fr_assert(request != NULL);
1975 u = talloc_get_type_abort(treq->rctx, bio_request_t);
1976 fr_assert(u == treq->preq);
1977
1978 /*
1979 * Validate and decode the incoming packet
1980 */
1981
1982 if (!check(h, &slen)) {
1983 RWARN("Ignoring malformed packet");
1984 continue;
1985 }
1986
1987 reason = decode(request->reply_ctx, &reply, &code, h, request, u, rr->vector, h->buffer, (size_t)slen);
1988 if (reason != DECODE_FAIL_NONE) continue;
1989
1990 /*
1991 * Only valid packets are processed
1992 * Otherwise an attacker could perform
1993 * a DoS attack against the proxying servers
1994 * by sending fake responses for upstream
1995 * servers.
1996 */
1997 h->last_reply = now = fr_time();
1998
1999 /*
2000 * Status-Server can have any reply code, we don't care
2001 * what it is. So long as it's signed properly, we
2002 * accept it. This flexibility is because we don't
2003 * expose Status-Server to the admins. It's only used by
2004 * this module for internal signalling.
2005 */
2006 if (u == h->status_u) {
2007 fr_pair_list_free(&reply); /* Probably want to pass this to status_check_reply? */
2008 status_check_reply(treq, now);
2009 trunk_request_signal_complete(treq);
2010 continue;
2011 }
2012
2013 /*
2014 * Handle any state changes, etc. needed by receiving a
2015 * Protocol-Error reply packet.
2016 *
2017 * Protocol-Error is permitted as a reply to any
2018 * packet.
2019 */
2020 switch (code) {
2021 case FR_RADIUS_CODE_PROTOCOL_ERROR:
2022 protocol_error_reply(u, h);
2023 break;
2024
2025 default:
2026 break;
2027 }
2028
2029 /*
2030 * Mark up the request as being an Access-Challenge, if
2031 * required.
2032 *
2033 * We don't do this for other packet types, because the
2034 * ok/fail nature of the module return code will
2035 * automatically result in it the parent request
2036 * returning an ok/fail packet code.
2037 */
2038 if ((u->code == FR_RADIUS_CODE_ACCESS_REQUEST) && (code == FR_RADIUS_CODE_ACCESS_CHALLENGE)) {
2039 vp = fr_pair_find_by_da(&request->reply_pairs, NULL, attr_packet_type);
2040 if (!vp) {
2041 MEM(vp = fr_pair_afrom_da(request->reply_ctx, attr_packet_type));
2042 vp->vp_uint32 = FR_RADIUS_CODE_ACCESS_CHALLENGE;
2043 fr_pair_append(&request->reply_pairs, vp);
2044 }
2045 }
2046
2047 /*
2048 * Delete Proxy-State attributes from the reply.
2049 */
2050 fr_pair_delete_by_da(&reply, attr_proxy_state);
2051
2052 /*
2053 * If the reply has Message-Authenticator, then over-ride its value with all zeros, so
2054 * that we don't confuse anyone reading the debug output.
2055 */
2056 if ((vp = fr_pair_find_by_da(&reply, NULL, attr_message_authenticator)) != NULL) {
2057 (void) fr_pair_value_memdup(vp, (uint8_t const *) "", 1, false);
2058 }
2059
2060 treq->request->reply->code = code;
2061 u->rcode = radius_code_to_rcode[code];
2062 fr_pair_list_append(&request->reply_pairs, &reply);
2063 trunk_request_signal_complete(treq);
2064 }
2065}
2066
2067/** Remove the request from any tracking structures
2068 *
2069 * Frees encoded packets if the request is being moved to a new connection
2070 */
2071static void request_cancel(UNUSED connection_t *conn, void *preq_to_reset,
2072 trunk_cancel_reason_t reason, UNUSED void *uctx)
2073{
2074 bio_request_t *u = preq_to_reset;
2075
2076 /*
2077 * Request has been requeued on the same
2078 * connection due to timeout or DUP signal. We
2079 * keep the same packet to avoid re-encoding it.
2080 */
2081 if (reason == TRUNK_CANCEL_REASON_REQUEUE) {
2082 /*
2083 * Delete the request_timeout
2084 *
2085 * Note: There might not be a request timeout
2086 * set in the case where the request was
2087 * queued for sendmmsg but never actually
2088 * sent.
2089 */
2090 if (u->ev) (void) fr_event_timer_delete(&u->ev);
2091 }
2092
2093 /*
2094 * Other cancellations are dealt with by
2095 * request_conn_release as the request is removed
2096 * from the trunk.
2097 */
2098}
2099
2100/** Clear out anything associated with the handle from the request
2101 *
2102 */
2103static void request_conn_release(connection_t *conn, void *preq_to_reset, UNUSED void *uctx)
2104{
2105 bio_request_t *u = preq_to_reset;
2106 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
2107
2108 if (u->ev) (void)fr_event_timer_delete(&u->ev);
2109 bio_request_reset(u);
2110
2111 if (h->ctx.inst->mode == RLM_RADIUS_MODE_REPLICATE) return;
2112
2113 u->num_replies = 0;
2114
2115 /*
2116 * If there are no outstanding tracking entries
2117 * allocated then the connection is "idle".
2118 */
2119 if (!h->tt || (h->tt->num_requests == 0)) h->last_idle = fr_time();
2120}
2121
2122/** Write out a canned failure
2123 *
2124 */
2125static void request_fail(request_t *request, NDEBUG_UNUSED void *preq, void *rctx,
2126 NDEBUG_UNUSED trunk_request_state_t state, UNUSED void *uctx)
2127{
2128 bio_request_t *u = talloc_get_type_abort(rctx, bio_request_t);
2129
2130 fr_assert(u == preq);
2131
2132 fr_assert(!u->rr && !u->packet && fr_pair_list_empty(&u->extra) && !u->ev); /* Dealt with by request_conn_release */
2133
2134 fr_assert(state != TRUNK_REQUEST_STATE_INIT);
2135
2136 if (u->status_check) return;
2137
2138 u->rcode = RLM_MODULE_FAIL;
2139 u->treq = NULL;
2140
2141 unlang_interpret_mark_runnable(request);
2142}
2143
2144/** Response has already been written to the rctx at this point
2145 *
2146 */
2147static void request_complete(request_t *request, NDEBUG_UNUSED void *preq, void *rctx, UNUSED void *uctx)
2148{
2149 bio_request_t *u = talloc_get_type_abort(rctx, bio_request_t);
2150
2151 fr_assert(u == preq);
2152
2153 fr_assert(!u->rr && !u->packet && fr_pair_list_empty(&u->extra) && !u->ev); /* Dealt with by request_conn_release */
2154
2155 if (u->status_check) return;
2156
2157 u->treq = NULL;
2158
2159 unlang_interpret_mark_runnable(request);
2160}
2161
2162/** Resume execution of the request, returning the rcode set during trunk execution
2163 *
2164 */
2165static unlang_action_t mod_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, UNUSED request_t *request)
2166{
2167 bio_request_t *u = talloc_get_type_abort(mctx->rctx, bio_request_t);
2168 rlm_rcode_t rcode = u->rcode;
2169
2170 talloc_free(u);
2171
2172 RETURN_MODULE_RCODE(rcode);
2173}
2174
2175static void do_signal(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_signal_t action);
2176
2177static void mod_signal(module_ctx_t const *mctx, UNUSED request_t *request, fr_signal_t action)
2178{
2179 rlm_radius_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_radius_t);
2180
2181 bio_request_t *u = talloc_get_type_abort(mctx->rctx, bio_request_t);
2182
2183 do_signal(inst, u, request, action);
2184}
2185
2186static void do_signal(rlm_radius_t const *inst, bio_request_t *u, UNUSED request_t *request, fr_signal_t action)
2187{
2188 /*
2189 * We received a duplicate packet, but we're not doing
2190 * synchronous proxying. Ignore the dup, and rely on the
2191 * IO submodule to time it's own retransmissions.
2192 */
2193 if ((action == FR_SIGNAL_DUP) && (inst->mode != RLM_RADIUS_MODE_PROXY)) return;
2194
2195 /*
2196 * If we don't have a treq associated with the
2197 * rctx it's likely because the request was
2198 * scheduled, but hasn't yet been resumed, and
2199 * has received a signal, OR has been resumed
2200 * and immediately cancelled as the event loop
2201 * is exiting, in which case
2202 * unlang_request_is_scheduled will return false
2203 * (don't use it).
2204 */
2205 if (!u->treq) return;
2206
2207 switch (action) {
2208 /*
2209 * The request is being cancelled, tell the
2210 * trunk so it can clean up the treq.
2211 */
2212 case FR_SIGNAL_CANCEL:
2213 trunk_request_signal_cancel(u->treq);
2214 u->treq = NULL;
2215 return;
2216
2217 /*
2218 * Requeue the request on the same connection
2219 * causing a "retransmission" if the request
2220 * has already been sent out.
2221 */
2222 case FR_SIGNAL_DUP:
2223 mod_dup(request, u);
2224 return;
2225
2226 default:
2227 return;
2228 }
2229}
2230
2231/** Free a bio_request_t
2232 *
2233 * Allows us to set break points for debugging.
2234 */
2235static int _bio_request_free(bio_request_t *u)
2236{
2237 if (!u->treq) return 0;
2238
2239#ifndef NDEBUG
2240 {
2241 trunk_request_t *treq;
2242 treq = talloc_get_type_abort(u->treq, trunk_request_t);
2243 fr_assert(treq->preq == u);
2244 }
2245#endif
2246
2247 fr_assert_msg(!u->ev, "bio_request_t freed with active timer");
2248
2249 if (u->ev) (void) fr_event_timer_delete(&u->ev);
2250
2251 fr_assert(u->rr == NULL);
2252
2253 return 0;
2254}
2255
2256static int mod_enqueue(bio_request_t **p_u, fr_retry_config_t const **p_retry_config,
2257 rlm_radius_t const *inst, trunk_t *trunk, request_t *request)
2258{
2259 bio_request_t *u;
2260 trunk_request_t *treq;
2261 fr_retry_config_t const *retry_config;
2262
2263 fr_assert(request->packet->code > 0);
2264 fr_assert(request->packet->code < FR_RADIUS_CODE_MAX);
2265
2266 /*
2267 * Do any necessary RADIUS level fixups
2268 * - check Proxy-State
2269 * - do CHAP-Challenge fixups
2270 */
2271 if (radius_fixups(inst, request) < 0) return 0;
2272
2273 treq = trunk_request_alloc(trunk, request);
2274 if (!treq) {
2275 REDEBUG("Failed allocating handler for request");
2276 return -1;
2277 }
2278
2279 MEM(u = talloc_zero(request, bio_request_t));
2280 talloc_set_destructor(u, _bio_request_free);
2281
2282 /*
2283 * Can't use compound literal - const issues.
2284 */
2285 u->code = request->packet->code;
2286 u->priority = request->async->priority;
2287 u->recv_time = request->async->recv_time;
2288 fr_pair_list_init(&u->extra);
2289
2290 u->retry.count = 1;
2291
2292 u->rcode = RLM_MODULE_FAIL;
2293
2294 switch(trunk_request_enqueue(&treq, trunk, request, u, u)) {
2295 case TRUNK_ENQUEUE_OK:
2296 case TRUNK_ENQUEUE_IN_BACKLOG:
2297 break;
2298
2299 case TRUNK_ENQUEUE_NO_CAPACITY:
2300 REDEBUG("Unable to queue packet - connections at maximum capacity");
2301 fail:
2302 fr_assert(!u->rr && !u->packet); /* Should not have been fed to the muxer */
2303 trunk_request_free(&treq); /* Return to the free list */
2304 talloc_free(u);
2305 return -1;
2306
2307 case TRUNK_ENQUEUE_DST_UNAVAILABLE:
2308 REDEBUG("All destinations are down - cannot send packet");
2309 goto fail;
2310
2311 case TRUNK_ENQUEUE_FAIL:
2312 REDEBUG("Unable to queue packet");
2313 goto fail;
2314 }
2315
2316 u->treq = treq; /* Remember for signalling purposes */
2317 fr_assert(treq->rctx == u);
2318
2319 /*
2320 * Figure out if we're originating the packet or proxying it. And also figure out if we have to
2321 * retry.
2322 */
2323 switch (inst->mode) {
2324 case RLM_RADIUS_MODE_INVALID:
2325 case RLM_RADIUS_MODE_UNCONNECTED_REPLICATE: /* unconnected sockets are UDP, and bypass the trunk */
2326 REDEBUG("Internal sanity check failed - connection trunking cannot be used for replication");
2327 return -1;
2328
2329 /*
2330 * We originate this packet if it was taken from the detail module, which doesn't have a
2331 * real client. @todo - do a better check here.
2332 *
2333 * We originate this packet if the parent request is not compatible with this one
2334 * (i.e. it's from a different protocol).
2335 *
2336 * We originate the packet if the parent is from the same dictionary, but has a different
2337 * packet code. This lets us receive Accounting-Request, and originate
2338 * Disconnect-Request.
2339 */
2340 case RLM_RADIUS_MODE_XLAT_PROXY:
2341 case RLM_RADIUS_MODE_PROXY:
2342 if (!request->parent) {
2343 u->proxied = (request->client->cs != NULL);
2344
2345 } else if (!fr_dict_compatible(request->parent->dict, request->dict)) {
2346 u->proxied = false;
2347
2348 } else {
2349 u->proxied = (request->parent->packet->code == request->packet->code);
2350 }
2351
2352 /*
2353 * Proxied packets get a final timeout, as we retry only on DUP packets.
2354 */
2355 if (u->proxied) goto timeout_retry;
2356
2357 FALL_THROUGH;
2358
2359 /*
2360 * Client packets (i.e. packets we originate) get retries for UDP. And no retries for TCP.
2361 */
2362 case RLM_RADIUS_MODE_CLIENT:
2363 if (inst->fd_config.socket_type == SOCK_DGRAM) {
2364 retry_config = &inst->retry[u->code];
2365 break;
2366 }
2367 FALL_THROUGH;
2368
2369 /*
2370 * Replicated packets are never retried, but they have a timeout if the socket isn't
2371 * ready for writing.
2372 */
2373 case RLM_RADIUS_MODE_REPLICATE:
2374 timeout_retry:
2375 retry_config = &inst->timeout_retry;
2376 break;
2377 }
2378
2379 /*
2380 * The event loop will take care of demux && sending the
2381 * packet, along with any retransmissions.
2382 */
2383 *p_u = u;
2384 *p_retry_config = retry_config;
2385
2386 return 1;
2387}
2388
2389static void home_server_free(void *data)
2390{
2391 home_server_t *home = data;
2392
2393 talloc_free(home);
2394}
2395
2396static const trunk_io_funcs_t io_funcs = {
2397 .connection_alloc = thread_conn_alloc,
2398 .connection_notify = thread_conn_notify,
2399 .request_prioritise = request_prioritise,
2400 .request_mux = request_mux,
2401 .request_demux = request_demux,
2402 .request_conn_release = request_conn_release,
2403 .request_complete = request_complete,
2404 .request_fail = request_fail,
2405 .request_cancel = request_cancel,
2406};
2407
2408/** Instantiate thread data for the submodule.
2409 *
2410 */
2411static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
2412{
2413 rlm_radius_t *inst = talloc_get_type_abort(mctx->mi->data, rlm_radius_t);
2414 bio_thread_t *thread = talloc_get_type_abort(mctx->thread, bio_thread_t);
2415
2416 thread->ctx.el = mctx->el;
2417 thread->ctx.inst = inst;
2418 thread->ctx.fd_config = inst->fd_config;
2419 thread->ctx.radius_ctx = inst->common_ctx;
2420
2421 switch (inst->mode) {
2422 case RLM_RADIUS_MODE_XLAT_PROXY:
2423 fr_rb_expire_inline_talloc_init(&thread->bio.expires, home_server_t, expire, home_server_cmp, home_server_free,
2424 inst->home_server_lifetime);
2425 FALL_THROUGH;
2426
2427 default:
2428 thread->ctx.trunk = trunk_alloc(thread, mctx->el, &io_funcs,
2429 &inst->trunk_conf, inst->name, thread, false);
2430 if (!thread->ctx.trunk) return -1;
2431 return 0;
2432
2433 case RLM_RADIUS_MODE_REPLICATE:
2434 case RLM_RADIUS_MODE_UNCONNECTED_REPLICATE:
2435 break;
2436 }
2437
2438 /*
2439 * If we have a port range, allocate the source IP based
2440 * on the range start, plus the thread ID. This means
2441 * that we can avoid "hunt and peck" attempts to open up
2442 * the source port.
2443 */
2444 if (thread->ctx.fd_config.src_port_start) {
2445 thread->ctx.fd_config.src_port = thread->ctx.fd_config.src_port_start + fr_schedule_worker_id();
2446 }
2447
2448 /*
2449 * Allocate the unconnected replication socket.
2450 */
2451 thread->bio.fd = fr_bio_fd_alloc(thread, &thread->ctx.fd_config, 0);
2452 if (!thread->bio.fd) {
2453 PERROR("%s - failed opening socket", inst->name);
2454 return CONNECTION_STATE_FAILED;
2455 }
2456
2457 thread->bio.fd->uctx = thread;
2458 thread->ctx.fd_info = fr_bio_fd_info(thread->bio.fd);
2459 fr_assert(thread->ctx.fd_info != NULL);
2460
2461 (void) fr_bio_fd_write_only(thread->bio.fd);
2462
2463 DEBUG("%s - Opened unconnected replication socket %s", inst->name, thread->ctx.fd_info->name);
2464 return 0;
2465}
2466
2467static xlat_arg_parser_t const xlat_radius_send_args[] = {
2468 { .required = true, .single = true, .type = FR_TYPE_COMBO_IP_ADDR },
2469 { .required = true, .single = true, .type = FR_TYPE_UINT16 },
2470 { .required = true, .single = true, .type = FR_TYPE_STRING },
2471 XLAT_ARG_PARSER_TERMINATOR
2472};
2473
2474/*
2475 * %replicate.sendto.ipaddr(ipaddr, port, secret)
2476 */
2477static xlat_action_t xlat_radius_replicate(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out,
2478 xlat_ctx_t const *xctx,
2479 request_t *request, fr_value_box_list_t *args)
2480{
2481 bio_thread_t *thread = talloc_get_type_abort(xctx->mctx->thread, bio_thread_t);
2482 fr_value_box_t *ipaddr, *port, *secret;
2483 ssize_t packet_len;
2484 uint8_t buffer[4096];
2485 fr_radius_ctx_t radius_ctx;
2486 fr_radius_encode_ctx_t encode_ctx;
2487 fr_bio_fd_packet_ctx_t addr;
2488
2489 XLAT_ARGS(args, &ipaddr, &port, &secret);
2490
2491 /*
2492 * Can't change IP address families.
2493 */
2494 if (ipaddr->vb_ip.af != thread->ctx.fd_info->socket.af) {
2495 RPERROR("Invalid destination IP address family in %pV", ipaddr);
2496 return XLAT_ACTION_FAIL;
2497 }
2498
2499 /*
2500 * Warn if we're not replicating accounting data. It likely won't wokr/
2501 */
2502 if (request->packet->code != FR_RADIUS_CODE_ACCOUNTING_REQUEST) {
2503 RWDEBUG("Replication of packets other then Accounting-Request will likely not do what you want.");
2504 }
2505
2506 /*
2507 * Set up various context things.
2508 */
2509 radius_ctx = (fr_radius_ctx_t) {
2510 .secret = secret->vb_strvalue,
2511 .secret_length = secret->vb_length,
2512 .proxy_state = 0,
2513 };
2514
2515 encode_ctx = (fr_radius_encode_ctx_t) {
2516 .common = &radius_ctx,
2517 .rand_ctx = (fr_fast_rand_t) {
2518 .a = fr_rand(),
2519 .b = fr_rand(),
2520 },
2521 .code = request->packet->code,
2522 .id = thread->bio.id++ & 0xff,
2523 .add_proxy_state = false,
2524 };
2525
2526 /*
2527 * Encode the entire packet.
2528 */
2529 packet_len = fr_radius_encode(&FR_DBUFF_TMP(buffer, sizeof(buffer)),
2530 &request->request_pairs, &encode_ctx);
2531 if (fr_pair_encode_is_error(packet_len)) {
2532 RPERROR("Failed encoding packet");
2533 return XLAT_ACTION_FAIL;
2534 }
2535
2536 /*
2537 * Sign it.
2538 */
2539 if (fr_radius_sign(buffer, NULL, (uint8_t const *) radius_ctx.secret, radius_ctx.secret_length) < 0) {
2540 RERROR("Failed signing packet");
2541 return XLAT_ACTION_FAIL;
2542 }
2543
2544 /*
2545 * Prepare destination address.
2546 */
2547 addr = (fr_bio_fd_packet_ctx_t) {
2548 .socket = thread->ctx.fd_info->socket,
2549 };
2550 addr.socket.inet.dst_ipaddr = ipaddr->vb_ip;
2551 addr.socket.inet.dst_port = port->vb_uint16;
2552
2553 RDEBUG("Replicating packet to %pV:%u", ipaddr, port->vb_uint16);
2554
2555 /*
2556 * We either send it, or fail.
2557 */
2558 packet_len = fr_bio_write(thread->bio.fd, &addr, buffer, packet_len);
2559 if (packet_len < 0) {
2560 RPERROR("Failed sending packet to %pV:%u", ipaddr, port->vb_uint16);
2561 return XLAT_ACTION_FAIL;
2562 }
2563
2564 /*
2565 * No return value.
2566 */
2567 return XLAT_ACTION_DONE;
2568}
2569
2570// **********************************************************************
2571
2572/** Dynamic home server code
2573 *
2574 */
2575
2576static int8_t home_server_cmp(void const *one, void const *two)
2577{
2578 home_server_t const *a = one;
2579 home_server_t const *b = two;
2580 int8_t rcode;
2581
2582 rcode = fr_ipaddr_cmp(&a->ctx.fd_config.dst_ipaddr, &b->ctx.fd_config.dst_ipaddr);
2583 if (rcode != 0) return rcode;
2584
2585 return CMP(a->ctx.fd_config.dst_port, b->ctx.fd_config.dst_port);
2586}
2587
2588static xlat_action_t xlat_sendto_resume(TALLOC_CTX *ctx, fr_dcursor_t *out,
2589 xlat_ctx_t const *xctx,
2590 request_t *request, UNUSED fr_value_box_list_t *in)
2591{
2592 bio_request_t *u = talloc_get_type_abort(xctx->rctx, bio_request_t);
2593 fr_value_box_t *dst;
2594
2595 if (u->rcode == RLM_MODULE_FAIL) return XLAT_ACTION_FAIL;
2596
2597 MEM(dst = fr_value_box_alloc(ctx, FR_TYPE_UINT32, attr_packet_type));
2598 dst->vb_uint32 = request->reply->code;
2599
2600 fr_dcursor_append(out, dst);
2601
2602 return XLAT_ACTION_DONE;
2603}
2604
2605static void xlat_sendto_signal(xlat_ctx_t const *xctx, request_t *request, fr_signal_t action)
2606{
2607 rlm_radius_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_radius_t);
2608 bio_request_t *u = talloc_get_type_abort(xctx->rctx, bio_request_t);
2609
2610 do_signal(inst, u, request, action);
2611}
2612
2613/*
2614 * @todo - change this to mod_retry
2615 */
2616static void xlat_sendto_retry(xlat_ctx_t const *xctx, request_t *request, fr_retry_t const *retry)
2617{
2618 rlm_radius_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_radius_t);
2619 bio_request_t *u = talloc_get_type_abort(xctx->rctx, bio_request_t);
2620
2621 do_retry(inst, u, request, retry);
2622}
2623
2624/*
2625 * %proxy.sendto.ipaddr(ipaddr, port, secret)
2626 */
2627static xlat_action_t xlat_radius_client(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out,
2628 xlat_ctx_t const *xctx,
2629 request_t *request, fr_value_box_list_t *args)
2630{
2631 rlm_radius_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_radius_t);
2632 bio_thread_t *thread = talloc_get_type_abort(xctx->mctx->thread, bio_thread_t);
2633 fr_value_box_t *ipaddr, *port, *secret;
2634 home_server_t *home;
2635 bio_request_t *u = NULL;
2636 fr_retry_config_t const *retry_config = NULL;
2637 int rcode;
2638
2639 XLAT_ARGS(args, &ipaddr, &port, &secret);
2640
2641 /*
2642 * Can't change IP address families.
2643 */
2644 if (ipaddr->vb_ip.af != thread->ctx.fd_config.src_ipaddr.af) {
2645 RDEBUG("Invalid destination IP address family in %pV", ipaddr);
2646 return XLAT_ACTION_DONE;
2647 }
2648
2649 home = fr_rb_find(&thread->bio.expires.tree, &(home_server_t) {
2650 .ctx = {
2651 .fd_config = (fr_bio_fd_config_t) {
2652 .dst_ipaddr = ipaddr->vb_ip,
2653 .dst_port = port->vb_uint16,
2654 },
2655 },
2656 });
2657 if (!home) {
2658 MEM(home = talloc(thread, home_server_t));
2659
2660 *home = (home_server_t) {
2661 .ctx = (bio_handle_ctx_t) {
2662 .el = unlang_interpret_event_list(request),
2663 .module_name = inst->name,
2664 .inst = inst,
2665 },
2666 };
2667
2668 /*
2669 * Copy the home server configuration from the root configuration. Then update it with
2670 * the needs of the home server.
2671 */
2672 home->ctx.fd_config = inst->fd_config;
2673 home->ctx.fd_config.type = FR_BIO_FD_CONNECTED;
2674 home->ctx.fd_config.dst_ipaddr = ipaddr->vb_ip;
2675 home->ctx.fd_config.dst_port = port->vb_uint32;
2676
2677 home->ctx.radius_ctx = (fr_radius_ctx_t) {
2678 .secret = talloc_strdup(home, secret->vb_strvalue),
2679 .secret_length = secret->vb_length,
2680 .proxy_state = inst->common_ctx.proxy_state,
2681 };
2682
2683 /*
2684 * Allocate the trunk and start it up.
2685 */
2686 home->ctx.trunk = trunk_alloc(home, unlang_interpret_event_list(request), &io_funcs,
2687 &inst->trunk_conf, inst->name, home, false);
2688 if (!home->ctx.trunk) {
2689 fail:
2690 talloc_free(home);
2691 return XLAT_ACTION_FAIL;
2692 }
2693
2694 if (!fr_rb_expire_insert(&thread->bio.expires, home, fr_time())) goto fail;
2695 } else {
2696 fr_rb_expire_t *expire = &thread->bio.expires;
2697 fr_time_t now = fr_time();
2698 home_server_t *old;
2699
2700 /*
2701 * We can't change secrets on the fly. The home
2702 * server has to expire first, and then the
2703 * secret can be changed.
2704 */
2705 if ((home->ctx.radius_ctx.secret_length != secret->vb_length) ||
2706 (strcmp(home->ctx.radius_ctx.secret, secret->vb_strvalue) != 0)) {
2707 RWDEBUG("The new secret is not the same as the old secret: Ignoring the new one");
2708 }
2709
2710 fr_rb_expire_update(expire, home, now);
2711
2712 while ((old = fr_dlist_head(&expire->head)) != NULL) {
2713 (void) talloc_get_type_abort(old, home_server_t);
2714
2715 fr_assert(old->ctx.trunk);
2716
2717 /*
2718 * Don't delete the home server we're about to use.
2719 */
2720 if (old == home) break;
2721
2722 /*
2723 * It still has a request allocated, do nothing.
2724 */
2725 if (old->ctx.trunk->req_alloc) break;
2726
2727 /*
2728 * Not yet time to expire.
2729 */
2730 if (fr_time_gt(old->expire.when, now)) break;
2731
2732 fr_dlist_remove(&expire->head, old);
2733 fr_rb_delete(&expire->tree, old);
2734 }
2735 }
2736
2737 /*
2738 * Enqueue the packet on the per-home-server trunk.
2739 */
2740 rcode = mod_enqueue(&u, &retry_config, inst, home->ctx.trunk, request);
2741 if (rcode == 0) return XLAT_ACTION_DONE;
2742
2743 if (rcode < 0) {
2744 REDEBUG("Failed enqueuing packet");
2745 return XLAT_ACTION_FAIL;
2746 }
2747 fr_assert(u != NULL);
2748 fr_assert(retry_config != NULL);
2749
2750 /*
2751 * Start the retry.
2752 *
2753 * @todo - change unlang_xlat_timeout_add() to unlang_xlat_retry_add().
2754 */
2755 fr_retry_init(&u->retry, fr_time(), retry_config);
2756
2757 return unlang_xlat_yield_to_retry(request, xlat_sendto_resume, xlat_sendto_retry,
2758 xlat_sendto_signal, ~(FR_SIGNAL_CANCEL | FR_SIGNAL_DUP),
2759 u, retry_config);
2760}
unlang_action_t
unlang_action_t
Returned by unlang_op_t calls, determine the next action of the interpreter.
Definition action.h:35
buffer
static int const char char buffer[256]
Definition acutest.h:576
file
int const char * file
Definition acutest.h:702
args
va_list args
Definition acutest.h:770
line
int const char int line
Definition acutest.h:702
fr_bio_write
static ssize_t fr_bio_write(fr_bio_t *bio, void *packet_ctx, void const *buffer, size_t size)
Write raw data to a bio.
Definition base.h:172
fr_bio_read
static ssize_t fr_bio_read(fr_bio_t *bio, void *packet_ctx, void *buffer, size_t size)
Read raw data from a bio.
Definition base.h:149
fr_bio_s::uctx
void * uctx
user ctx, caller can manually set it.
Definition base.h:113
fr_bio_error
#define fr_bio_error(_x)
Definition base.h:192
fr_bio_s
Definition base.h:112
NDEBUG_UNUSED
#define NDEBUG_UNUSED
Definition build.h:326
FALL_THROUGH
#define FALL_THROUGH
clang 10 doesn't recognised the FALL-THROUGH comment anymore
Definition build.h:322
CMP_PREFER_SMALLER
#define CMP_PREFER_SMALLER(_a, _b)
Evaluates to +1 for a > b, and -1 for a < b.
Definition build.h:104
CC_NO_UBSAN
#define CC_NO_UBSAN(_sanitize)
Definition build.h:426
CMP
#define CMP(_a, _b)
Same as CMP_PREFER_SMALLER use when you don't really care about ordering, you just want an ordering.
Definition build.h:112
unlikely
#define unlikely(_x)
Definition build.h:381
UNUSED
#define UNUSED
Definition build.h:315
connection_state_t
connection_state_t
Definition connection.h:45
CONNECTION_STATE_FAILED
@ CONNECTION_STATE_FAILED
Connection has failed.
Definition connection.h:54
CONNECTION_STATE_CONNECTED
@ CONNECTION_STATE_CONNECTED
File descriptor is open (ready for writing).
Definition connection.h:52
CONNECTION_STATE_INIT
@ CONNECTION_STATE_INIT
Init state, sets up connection.
Definition connection.h:49
CONNECTION_STATE_CONNECTING
@ CONNECTION_STATE_CONNECTING
Waiting for connection to establish.
Definition connection.h:50
CONNECTION_FAILED
@ CONNECTION_FAILED
Connection is being reconnected because it failed.
Definition connection.h:84
connection_conf_t
Definition connection.h:91
connection_funcs_t
Holds a complete set of functions for a connection.
Definition connection.h:186
FR_DBUFF_TMP
#define FR_DBUFF_TMP(_start, _len_or_end)
Creates a compound literal to pass into functions which accept a dbuff.
Definition dbuff.h:514
fr_dcursor_append
static int fr_dcursor_append(fr_dcursor_t *cursor, void *v)
Insert a single item at the end of the list.
Definition dcursor.h:406
fr_dcursor_s
Definition dcursor.h:93
fr_assert_msg
#define fr_assert_msg(_x, _msg,...)
Calls panic_action ifndef NDEBUG, else logs error and causes the server to exit immediately with code...
Definition debug.h:210
fr_assert_fail
#define fr_assert_fail(_msg,...)
Calls panic_action ifndef NDEBUG, else logs error.
Definition debug.h:216
MEM
#define MEM(x)
Definition debug.h:36
FR_RADIUS_CODE_ACCESS_CHALLENGE
@ FR_RADIUS_CODE_ACCESS_CHALLENGE
RFC2865 - Access-Challenge.
Definition defs.h:43
FR_RADIUS_CODE_ACCESS_REQUEST
@ FR_RADIUS_CODE_ACCESS_REQUEST
RFC2865 - Access-Request.
Definition defs.h:33
FR_RADIUS_CODE_MAX
@ FR_RADIUS_CODE_MAX
Maximum possible protocol code.
Definition defs.h:53
FR_RADIUS_CODE_DISCONNECT_ACK
@ FR_RADIUS_CODE_DISCONNECT_ACK
RFC3575/RFC5176 - Disconnect-Ack (positive)
Definition defs.h:47
FR_RADIUS_CODE_ACCESS_ACCEPT
@ FR_RADIUS_CODE_ACCESS_ACCEPT
RFC2865 - Access-Accept.
Definition defs.h:34
FR_RADIUS_CODE_ACCOUNTING_RESPONSE
@ FR_RADIUS_CODE_ACCOUNTING_RESPONSE
RFC2866 - Accounting-Response.
Definition defs.h:37
FR_RADIUS_CODE_COA_NAK
@ FR_RADIUS_CODE_COA_NAK
RFC3575/RFC5176 - CoA-Nak (not willing to perform)
Definition defs.h:51
FR_RADIUS_CODE_COA_ACK
@ FR_RADIUS_CODE_COA_ACK
RFC3575/RFC5176 - CoA-Ack (positive)
Definition defs.h:50
FR_RADIUS_CODE_DISCONNECT_NAK
@ FR_RADIUS_CODE_DISCONNECT_NAK
RFC3575/RFC5176 - Disconnect-Nak (not willing to perform)
Definition defs.h:48
FR_RADIUS_CODE_PROTOCOL_ERROR
@ FR_RADIUS_CODE_PROTOCOL_ERROR
RFC7930 - Protocol-Error (generic NAK)
Definition defs.h:52
FR_RADIUS_CODE_ACCOUNTING_REQUEST
@ FR_RADIUS_CODE_ACCOUNTING_REQUEST
RFC2866 - Accounting-Request.
Definition defs.h:36
FR_RADIUS_CODE_ACCESS_REJECT
@ FR_RADIUS_CODE_ACCESS_REJECT
RFC2865 - Access-Reject.
Definition defs.h:35
attr_packet_type
static fr_dict_attr_t const * attr_packet_type
Definition dhcpclient.c:89
ERROR
#define ERROR(fmt,...)
Definition dhcpclient.c:41
DEBUG
#define DEBUG(fmt,...)
Definition dhcpclient.c:39
fr_dict_compatible
bool fr_dict_compatible(fr_dict_t const *dict1, fr_dict_t const *dict2)
See if two dictionaries have the same end parent.
Definition dict_util.c:2626
in
static fr_slen_t in
Definition dict.h:827
fr_dlist_head
static void * fr_dlist_head(fr_dlist_head_t const *list_head)
Return the HEAD item of a list or NULL if the list is empty.
Definition dlist.h:486
fr_dlist_remove
static void * fr_dlist_remove(fr_dlist_head_t *list_head, void *ptr)
Remove an item from the list.
Definition dlist.h:638
fr_event_fd_insert
#define fr_event_fd_insert(...)
Definition event.h:232
fr_event_fd_cb_t
void(* fr_event_fd_cb_t)(fr_event_list_t *el, int fd, int flags, void *uctx)
Called when an IO event occurs on a file descriptor.
Definition event.h:137
fr_event_timer_at
#define fr_event_timer_at(...)
Definition event.h:250
fr_bio_fd_connect_full
int fr_bio_fd_connect_full(fr_bio_t *bio, fr_event_list_t *el, fr_bio_callback_t connected_cb, fr_bio_callback_t error_cb, fr_time_delta_t *timeout, fr_bio_callback_t timeout_cb)
Finalize a connect()
Definition fd.c:1253
fr_bio_fd_alloc
fr_bio_t * fr_bio_fd_alloc(TALLOC_CTX *ctx, fr_bio_fd_config_t const *cfg, size_t offset)
Allocate a FD bio.
Definition fd.c:1030
fr_bio_fd_info
fr_bio_fd_info_t const * fr_bio_fd_info(fr_bio_t *bio)
Returns a pointer to the bio-specific information.
Definition fd.c:1350
fr_bio_fd_write_only
int fr_bio_fd_write_only(fr_bio_t *bio)
Mark up a bio as write-only.
Definition fd.c:1380
fr_bio_fd_info_t::socket
fr_socket_t socket
as connected socket
Definition fd.h:129
fr_bio_fd_info_t::name
char const * name
printable name of this BIO
Definition fd.h:134
fr_bio_fd_config_t::src_port
uint16_t src_port
our port
Definition fd.h:92
fr_bio_fd_info_t::eof
bool eof
are we at EOF?
Definition fd.h:138
FR_BIO_FD_CONNECTED
@ FR_BIO_FD_CONNECTED
connected client sockets (UDP or TCP)
Definition fd.h:68
fr_bio_fd_info_t::state
fr_bio_fd_state_t state
connecting, open, closed, etc.
Definition fd.h:132
fr_bio_fd_config_t::src_port_start
uint16_t src_port_start
limit source port ranges for client BIOs
Definition fd.h:95
FR_BIO_FD_STATE_CONNECTING
@ FR_BIO_FD_STATE_CONNECTING
Definition fd.h:60
FR_BIO_FD_STATE_OPEN
@ FR_BIO_FD_STATE_OPEN
error states must be before this
Definition fd.h:59
fr_bio_fd_info_t::connect_errno
int connect_errno
from connect() or other APIs
Definition fd.h:140
fr_bio_fd_config_t::dst_ipaddr
fr_ipaddr_t dst_ipaddr
their IP address
Definition fd.h:90
fr_bio_fd_config_t::socket_type
int socket_type
SOCK_STREAM or SOCK_DGRAM.
Definition fd.h:84
fr_bio_fd_config_t::dst_port
uint16_t dst_port
their port
Definition fd.h:93
fr_bio_fd_packet_ctx_t::socket
fr_socket_t socket
socket information, including FD.
Definition fd.h:52
fr_bio_fd_info_t::write_blocked
bool write_blocked
did we block on write?
Definition fd.h:137
fr_bio_fd_config_t::src_ipaddr
fr_ipaddr_t src_ipaddr
our IP address
Definition fd.h:89
fr_bio_fd_config_t
Configuration for sockets.
Definition fd.h:81
fr_bio_fd_info_t
Run-time status of the socket.
Definition fd.h:128
fr_bio_fd_packet_ctx_t
Per-packet context.
Definition fd.h:51
fr_ipaddr_cmp
int8_t fr_ipaddr_cmp(fr_ipaddr_t const *a, fr_ipaddr_t const *b)
Compare two ip addresses.
Definition inet.c:1346
fr_ipaddr_t::af
int af
Address family.
Definition inet.h:64
unlang_interpret_mark_runnable
void unlang_interpret_mark_runnable(request_t *request)
Mark a request as resumable.
Definition interpret.c:1374
unlang_interpret_event_list
fr_event_list_t * unlang_interpret_event_list(request_t *request)
Get the event list for the current interpreter.
Definition interpret.c:1779
fr_async_s
Minimal data structure to use the new code.
Definition listen.h:58
fr_pair_encode_is_error
static bool fr_pair_encode_is_error(ssize_t slen)
Determine if the return code for an encoding function is a fatal error.
Definition pair.h:74
fr_bio_mem_alloc
fr_bio_t * fr_bio_mem_alloc(TALLOC_CTX *ctx, size_t read_size, size_t write_size, fr_bio_t *next)
Allocate a memory buffer bio.
Definition mem.c:727
fr_bio_mem_set_verify
int fr_bio_mem_set_verify(fr_bio_t *bio, fr_bio_verify_t verify, void *verify_ctx, bool datagram)
Set the verification function for memory bios.
Definition mem.c:880
attr_eap_message
HIDDEN fr_dict_attr_t const * attr_eap_message
Definition base.c:96
log_request_pair_list
void log_request_pair_list(fr_log_lvl_t lvl, request_t *request, fr_pair_t const *parent, fr_pair_list_t const *vps, char const *prefix)
Print a fr_pair_list_t.
Definition log.c:830
PERROR
#define PERROR(_fmt,...)
Definition log.h:228
DEBUG3
#define DEBUG3(_fmt,...)
Definition log.h:266
RWDEBUG
#define RWDEBUG(fmt,...)
Definition log.h:361
RWARN
#define RWARN(fmt,...)
Definition log.h:297
RERROR
#define RERROR(fmt,...)
Definition log.h:298
DEBUG4
#define DEBUG4(_fmt,...)
Definition log.h:267
RPERROR
#define RPERROR(fmt,...)
Definition log.h:302
RINFO
#define RINFO(fmt,...)
Definition log.h:296
RPEDEBUG
#define RPEDEBUG(fmt,...)
Definition log.h:376
HEXDUMP3
#define HEXDUMP3(_data, _len, _fmt,...)
Definition log.h:723
RHEXDUMP3
#define RHEXDUMP3(_data, _len, _fmt,...)
Definition log.h:705
map_to_vp
int map_to_vp(TALLOC_CTX *ctx, fr_pair_list_t *out, request_t *request, map_t const *map, UNUSED void *uctx)
Convert a map to a fr_pair_t.
Definition map.c:1567
map_to_request
int map_to_request(request_t *request, map_t const *map, radius_map_getvalue_t func, void *ctx)
Convert map_t to fr_pair_t (s) and add them to a request_t.
Definition map.c:1861
talloc_free
talloc_free(reap)
fr_event_timer_delete
int fr_event_timer_delete(fr_event_timer_t const **ev_p)
Delete a timer event from the event list.
Definition event.c:1611
fr_event_list
Stores all information relating to an event list.
Definition event.c:411
fr_event_timer
A timer event.
Definition event.c:102
default_log
fr_log_t default_log
Definition log.c:291
fr_log
void fr_log(fr_log_t const *log, fr_log_type_t type, char const *file, int line, char const *fmt,...)
Send a server log message to its destination.
Definition log.c:583
L_DBG_LVL_3
@ L_DBG_LVL_3
3rd highest priority debug messages (-xxx | -Xx).
Definition log.h:72
L_DBG_LVL_2
@ L_DBG_LVL_2
2nd highest priority debug messages (-xx | -X).
Definition log.h:71
fr_log_type_t
fr_log_type_t
Definition log.h:54
L_ERR
@ L_ERR
Error message.
Definition log.h:56
fr_packet_alloc
fr_packet_t * fr_packet_alloc(TALLOC_CTX *ctx, bool new_vector)
Allocate a new fr_packet_t.
Definition packet.c:38
fr_bio_verify_action_t
fr_bio_verify_action_t
Status returned by the verification callback.
Definition mem.h:32
FR_BIO_VERIFY_ERROR_CLOSE
@ FR_BIO_VERIFY_ERROR_CLOSE
fatal error, the bio should be closed.
Definition mem.h:36
FR_BIO_VERIFY_DISCARD
@ FR_BIO_VERIFY_DISCARD
the packet should be discarded
Definition mem.h:34
FR_BIO_VERIFY_OK
@ FR_BIO_VERIFY_OK
packet is OK
Definition mem.h:33
FR_BIO_VERIFY_WANT_MORE
@ FR_BIO_VERIFY_WANT_MORE
not enough data for one packet
Definition mem.h:35
fr_radius_ok
bool fr_radius_ok(uint8_t const *packet, size_t *packet_len_p, uint32_t max_attributes, bool require_message_authenticator, decode_fail_t *reason)
Definition merged_model.c:259
FR_TYPE_STRING
@ FR_TYPE_STRING
String of printable characters.
Definition merged_model.c:83
FR_TYPE_UINT16
@ FR_TYPE_UINT16
16 Bit unsigned integer.
Definition merged_model.c:98
FR_TYPE_UINT32
@ FR_TYPE_UINT32
32 Bit unsigned integer.
Definition merged_model.c:99
FR_TYPE_COMBO_IP_ADDR
@ FR_TYPE_COMBO_IP_ADDR
IPv4 or IPv6 address depending on length.
Definition merged_model.c:91
uint32_t
unsigned int uint32_t
Definition merged_model.c:33
ssize_t
long int ssize_t
Definition merged_model.c:24
uint8_t
unsigned char uint8_t
Definition merged_model.c:30
fr_value_box_t
Definition merged_model.c:136
request_t
Definition merged_model.c:210
module_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition module_ctx.h:42
module_ctx_t::thread
void * thread
Thread specific instance data.
Definition module_ctx.h:43
module_ctx_t::rctx
void * rctx
Resume ctx that a module previously set.
Definition module_ctx.h:45
module_thread_inst_ctx_t::el
fr_event_list_t * el
Event list to register any IO handlers and timers against.
Definition module_ctx.h:68
module_thread_inst_ctx_t::thread
void * thread
Thread instance data.
Definition module_ctx.h:67
module_thread_inst_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition module_ctx.h:64
module_ctx_t
Temporary structure to hold arguments for module calls.
Definition module_ctx.h:41
module_thread_inst_ctx_t
Temporary structure to hold arguments for thread_instantiation calls.
Definition module_ctx.h:63
mod_enqueue
static int mod_enqueue(bio_request_t **p_u, fr_retry_config_t const **p_retry_config, rlm_radius_t const *inst, trunk_t *trunk, request_t *request)
Definition bio.c:2256
bio_handle_ctx_t::fd_config
fr_bio_fd_config_t fd_config
for threads or sockets
Definition bio.c:52
request_prioritise
static int8_t request_prioritise(void const *one, void const *two)
Definition bio.c:1034
do_retry
static void do_retry(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_retry_t const *retry)
Definition bio.c:1427
check_for_zombie
static bool check_for_zombie(fr_event_list_t *el, trunk_connection_t *tconn, fr_time_t now, fr_time_t last_sent)
See if the connection is zombied.
Definition bio.c:1324
conn_init_error
static void conn_init_error(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, void *uctx)
Connection errored.
Definition bio.c:332
request_demux
static void request_demux(UNUSED fr_event_list_t *el, trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
Definition bio.c:1907
conn_discard
static void conn_discard(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
Read and discard data.
Definition bio.c:918
bio_request_s::id
uint8_t id
Last ID assigned to this packet.
Definition bio.c:129
bio_handle_t::max_packet_size
uint32_t max_packet_size
Our max packet size. may be different from the parent.
Definition bio.c:89
do_signal
static void do_signal(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_signal_t action)
bio_connected
static void bio_connected(fr_bio_t *bio)
Definition bio.c:627
bio_request_s::num_replies
uint32_t num_replies
number of reply packets, sent is in retry.count
Definition bio.c:121
io_funcs
static const trunk_io_funcs_t io_funcs
Definition bio.c:2396
bio_request_s::priority
uint32_t priority
copied from request->async->priority
Definition bio.c:118
radius_code_to_rcode
static rlm_rcode_t radius_code_to_rcode[FR_RADIUS_CODE_MAX]
Turn a reply code into a module rcode;.
Definition bio.c:148
conn_init_timeout
static void conn_init_timeout(fr_event_list_t *el, fr_time_t now, void *uctx)
Status check timer when opening the connection for the first time.
Definition bio.c:353
conn_error
static void conn_error(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, void *uctx)
Connection errored.
Definition bio.c:953
bio_handle_ctx_t::module_name
char const * module_name
the module that opened the connection
Definition bio.c:48
bio_handle_ctx_t::fd_info
fr_bio_fd_info_t const * fd_info
status of the FD.
Definition bio.c:53
mod_signal
static void mod_signal(module_ctx_t const *mctx, UNUSED request_t *request, fr_signal_t action)
Definition bio.c:2177
bio_handle_t::last_id
uint8_t last_id
Used when replicating to ensure IDs are distributed evenly.
Definition bio.c:86
mod_retry
static void mod_retry(module_ctx_t const *mctx, request_t *request, fr_retry_t const *retry)
Handle module retries.
Definition bio.c:1419
decode
static fr_radius_decode_fail_t decode(TALLOC_CTX *ctx, fr_pair_list_t *reply, uint8_t *response_code, bio_handle_t *h, request_t *request, bio_request_t *u, uint8_t const request_authenticator[static RADIUS_AUTH_VECTOR_LENGTH], uint8_t *data, size_t data_len)
Decode response packet data, extracting relevant information and validating the packet.
Definition bio.c:1073
conn_close
static void conn_close(UNUSED fr_event_list_t *el, void *handle, UNUSED void *uctx)
Shutdown/close a file descriptor.
Definition bio.c:835
thread_conn_notify
static void thread_conn_notify(trunk_connection_t *tconn, connection_t *conn, fr_event_list_t *el, trunk_connection_event_t notify_on, UNUSED void *uctx)
Definition bio.c:965
encode
static int encode(bio_handle_t *h, request_t *request, bio_request_t *u, uint8_t id)
Definition bio.c:1140
bio_handle_t::last_reply
fr_time_t last_reply
When we last received a reply.
Definition bio.c:97
request_conn_release
static void request_conn_release(connection_t *conn, void *preq_to_reset, UNUSED void *uctx)
Clear out anything associated with the handle from the request.
Definition bio.c:2103
bio_handle_t::fd
int fd
File descriptor.
Definition bio.c:75
bio_handle_t::status_u
bio_request_t * status_u
for sending status check packets
Definition bio.c:105
bio_thread_t::ctx
bio_handle_ctx_t ctx
common struct for home servers and BIO handles
Definition bio.c:58
rlm_radius_verify
static fr_bio_verify_action_t rlm_radius_verify(UNUSED fr_bio_t *bio, void *verify_ctx, UNUSED void *packet_ctx, const void *data, size_t *size)
Definition bio.c:646
mod_write
static void mod_write(request_t *request, trunk_request_t *treq, bio_handle_t *h)
Definition bio.c:1519
bio_request_s::ev
fr_event_timer_t const * ev
timer for retransmissions
Definition bio.c:135
REQUIRE_MA
#define REQUIRE_MA(_h)
check
#define check(_handle, _len_p)
Definition bio.c:44
bio_request_s::extra
fr_pair_list_t extra
VPs for debugging, like Proxy-State.
Definition bio.c:126
bio_request_s::proxied
bool proxied
is this request being proxied
Definition bio.c:124
bio_handle_t::buflen
size_t buflen
Receive buffer length.
Definition bio.c:92
bio_thread_t::bio
struct bio_thread_t::@171 bio
conn_init_readable
static void conn_init_readable(fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
Read the connection during the init and negotiation stage.
Definition bio.c:415
zombie_timeout
static void zombie_timeout(fr_event_list_t *el, fr_time_t now, void *uctx)
Mark a connection dead after "zombie_interval".
Definition bio.c:1267
bio_handle_t::last_idle
fr_time_t last_idle
last time we had nothing to do
Definition bio.c:100
bio_tracking_entry_log
static void bio_tracking_entry_log(fr_log_t const *log, fr_log_type_t log_type, char const *file, int line, radius_track_entry_t *te)
Log additional information about a tracking entry.
Definition bio.c:191
xlat_radius_replicate
static xlat_action_t xlat_radius_replicate(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *args)
Definition bio.c:2477
bio_request_s::rr
radius_track_entry_t * rr
ID tracking, resend count, etc.
Definition bio.c:134
bio_request_s::packet_len
size_t packet_len
Length of the packet.
Definition bio.c:131
_bio_handle_free
static int _bio_handle_free(bio_handle_t *h)
Free a connection handle, closing associated resources.
Definition bio.c:610
bio_request_s::partial
size_t partial
partially sent data
Definition bio.c:132
bio_handle_ctx_t::el
fr_event_list_t * el
Event list.
Definition bio.c:50
request_cancel
static void request_cancel(UNUSED connection_t *conn, void *preq_to_reset, trunk_cancel_reason_t reason, UNUSED void *uctx)
Remove the request from any tracking structures.
Definition bio.c:2071
home_server_free
static void home_server_free(void *data)
Definition bio.c:2389
status_check_next
static void status_check_next(UNUSED fr_event_list_t *el, UNUSED fr_time_t now, void *uctx)
Handle retries for a status check.
Definition bio.c:1844
revive_timeout
static void revive_timeout(UNUSED fr_event_list_t *el, UNUSED fr_time_t now, void *uctx)
Revive a connection after "revive_interval".
Definition bio.c:1255
protocol_error_reply
static void protocol_error_reply(bio_request_t *u, bio_handle_t *h)
Deal with Protocol-Error replies, and possible negotiation.
Definition bio.c:1729
status_check_reset
static void status_check_reset(bio_handle_t *h, bio_request_t *u)
Reset a status_check packet, ready to reuse.
Definition bio.c:227
request_fail
static void request_fail(request_t *request, NDEBUG_UNUSED void *preq, void *rctx, NDEBUG_UNUSED trunk_request_state_t state, UNUSED void *uctx)
Write out a canned failure.
Definition bio.c:2125
bio_request_s::recv_time
fr_time_t recv_time
copied from request->async->recv_time
Definition bio.c:119
bio_request_s::retry
fr_retry_t retry
retransmission timers
Definition bio.c:136
conn_init_writable
static void conn_init_writable(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
xlat_radius_client
static xlat_action_t xlat_radius_client(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *args)
Definition bio.c:2627
bio_request_s::rcode
rlm_rcode_t rcode
from the transport
Definition bio.c:115
status_check_alloc
static void status_check_alloc(bio_handle_t *h)
Definition bio.c:244
bio_handle_t::mrs_time
fr_time_t mrs_time
Most recent sent time which had a reply.
Definition bio.c:96
bio_handle_t::status_checking
bool status_checking
whether we're doing status checks
Definition bio.c:104
bio_handle_ctx_t::trunk
trunk_t * trunk
trunk handler
Definition bio.c:51
bio_handle_t::last_sent
fr_time_t last_sent
last time we sent a packet.
Definition bio.c:99
conn_init_next
static void conn_init_next(fr_event_list_t *el, UNUSED fr_time_t now, void *uctx)
Perform the next step of init and negotiation.
Definition bio.c:401
home_server_t::ctx
bio_handle_ctx_t ctx
for copying to bio_handle_t
Definition bio.c:140
mod_thread_instantiate
static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
Instantiate thread data for the submodule.
Definition bio.c:2411
bio_error
static void bio_error(fr_bio_t *bio)
Definition bio.c:636
status_check_reply
static void status_check_reply(trunk_request_t *treq, fr_time_t now)
Deal with replies replies to status checks and possible negotiation.
Definition bio.c:1859
mod_resume
static unlang_action_t mod_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, UNUSED request_t *request)
Resume execution of the request, returning the rcode set during trunk execution.
Definition bio.c:2165
bio_request_s::is_retry
bool is_retry
Definition bio.c:116
_bio_request_free
static int _bio_request_free(bio_request_t *u)
Free a bio_request_t.
Definition bio.c:2235
bio_handle_t::conn
connection_t * conn
Definition bio.c:84
bio_handle_t::first_sent
fr_time_t first_sent
first time we sent a packet since going idle
Definition bio.c:98
thread_conn_alloc
static connection_t * thread_conn_alloc(trunk_connection_t *tconn, fr_event_list_t *el, connection_conf_t const *conf, char const *log_prefix, void *uctx)
Definition bio.c:889
xlat_sendto_retry
static void xlat_sendto_retry(xlat_ctx_t const *xctx, request_t *request, fr_retry_t const *retry)
Definition bio.c:2616
bio_request_reset
static void bio_request_reset(bio_request_t *u)
Clear out any connection specific resources from a udp request.
Definition bio.c:210
bio_request_s::treq
trunk_request_t * treq
Definition bio.c:114
bio_handle_t::bio
struct bio_handle_t::@172 bio
xlat_sendto_resume
static xlat_action_t xlat_sendto_resume(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, UNUSED fr_value_box_list_t *in)
Definition bio.c:2588
bio_handle_ctx_t::inst
rlm_radius_t const * inst
our instance
Definition bio.c:49
conn_init
static connection_state_t conn_init(void **h_out, connection_t *conn, void *uctx)
Initialise a new outbound connection.
Definition bio.c:708
home_server_t::expire
fr_rb_expire_node_t expire
Definition bio.c:142
bio_request_s::packet
uint8_t * packet
Packet we write to the network.
Definition bio.c:130
conn_failed
static connection_state_t conn_failed(void *handle, connection_state_t state, UNUSED void *uctx)
Connection failed.
Definition bio.c:862
bio_handle_ctx_t::radius_ctx
fr_radius_ctx_t radius_ctx
Definition bio.c:54
bio_handle_t::tt
radius_track_t * tt
RADIUS ID tracking structure.
Definition bio.c:94
mod_dup
static void mod_dup(request_t *request, bio_request_t *u)
Definition bio.c:1383
bio_handle_t::ctx
bio_handle_ctx_t ctx
common struct for home servers and BIO handles
Definition bio.c:73
bio_handle_t::zombie_ev
fr_event_timer_t const * zombie_ev
Zombie timeout.
Definition bio.c:102
home_server_cmp
static int8_t home_server_cmp(void const *one, void const *two)
Dynamic home server code.
Definition bio.c:2576
bio_request_s::code
uint8_t code
Packet code.
Definition bio.c:128
request_mux
static void request_mux(UNUSED fr_event_list_t *el, trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
Definition bio.c:1500
bio_handle_t::buffer
uint8_t * buffer
Receive buffer.
Definition bio.c:91
bio_handle_t::status_request
request_t * status_request
Definition bio.c:106
request_complete
static void request_complete(request_t *request, NDEBUG_UNUSED void *preq, void *rctx, UNUSED void *uctx)
Response has already been written to the rctx at this point.
Definition bio.c:2147
bio_request_s::status_check
bool status_check
is this packet a status check?
Definition bio.c:123
xlat_radius_send_args
static xlat_arg_parser_t const xlat_radius_send_args[]
Definition bio.c:2467
xlat_sendto_signal
static void xlat_sendto_signal(xlat_ctx_t const *xctx, request_t *request, fr_signal_t action)
Definition bio.c:2605
bio_handle_ctx_t
Definition bio.c:47
bio_handle_t
Track the handle, which is tightly correlated with the FD.
Definition bio.c:72
bio_request_s
Connect request_t to local tracking structure.
Definition bio.c:113
bio_thread_t
Definition bio.c:57
home_server_t
Definition bio.c:139
fr_nbo_to_uint16
static uint16_t fr_nbo_to_uint16(uint8_t const data[static sizeof(uint16_t)])
Read an unsigned 16bit integer from wire format (big endian)
Definition nbo.h:146
RADIUS_HEADER_LENGTH
#define RADIUS_HEADER_LENGTH
Definition net.h:80
RADIUS_AUTH_VECTOR_LENGTH
#define RADIUS_AUTH_VECTOR_LENGTH
Definition net.h:89
fr_pair_value_memdup
int fr_pair_value_memdup(fr_pair_t *vp, uint8_t const *src, size_t len, bool tainted)
Copy data into an "octets" data type.
Definition pair.c:2983
fr_pair_value_strdup
int fr_pair_value_strdup(fr_pair_t *vp, char const *src, bool tainted)
Copy data into an "string" data type.
Definition pair.c:2636
fr_pair_find_by_da
fr_pair_t * fr_pair_find_by_da(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find the first pair with a matching da.
Definition pair.c:695
fr_pair_append
int fr_pair_append(fr_pair_list_t *list, fr_pair_t *to_add)
Add a VP to the end of the list.
Definition pair.c:1347
fr_pair_delete_by_da
int fr_pair_delete_by_da(fr_pair_list_t *list, fr_dict_attr_t const *da)
Delete matching pairs from the specified list.
Definition pair.c:1691
fr_pair_afrom_da
fr_pair_t * fr_pair_afrom_da(TALLOC_CTX *ctx, fr_dict_attr_t const *da)
Dynamically allocate a new attribute and assign a fr_dict_attr_t.
Definition pair.c:285
fr_pair_list_init
void fr_pair_list_init(fr_pair_list_t *list)
Initialise a pair list header.
Definition pair.c:46
encode_ctx
static fr_internal_encode_ctx_t encode_ctx
Definition proto_ldap_sync.c:34
fr_radius_decode
ssize_t fr_radius_decode(TALLOC_CTX *ctx, fr_pair_list_t *out, uint8_t *packet, size_t packet_len, fr_radius_decode_ctx_t *decode_ctx)
Definition base.c:1086
fr_radius_sign
int fr_radius_sign(uint8_t *packet, uint8_t const *vector, uint8_t const *secret, size_t secret_len)
Sign a previously encoded packet.
Definition base.c:358
fr_radius_encode
ssize_t fr_radius_encode(fr_dbuff_t *dbuff, fr_pair_list_t *vps, fr_radius_encode_ctx_t *packet_ctx)
Definition base.c:951
fr_radius_packet_name
char const * fr_radius_packet_name[FR_RADIUS_CODE_MAX]
Definition base.c:112
fr_assert
#define fr_assert(_expr)
Definition rad_assert.h:38
secret
static char * secret
Definition radclient-ng.c:69
attr_proxy_state
static fr_dict_attr_t const * attr_proxy_state
Definition radclient.c:127
REDEBUG
#define REDEBUG(fmt,...)
Definition radclient.h:52
RDEBUG
#define RDEBUG(fmt,...)
Definition radclient.h:53
WARN
#define WARN(fmt,...)
Definition radclient.h:47
INFO
#define INFO(fmt,...)
Definition radict.c:54
FR_RADIUS_REQUIRE_MA_AUTO
@ FR_RADIUS_REQUIRE_MA_AUTO
Only require Message-Authenticator if we've previously received a packet from this client with Messag...
Definition radius.h:65
RADIUS_AUTH_VECTOR_OFFSET
#define RADIUS_AUTH_VECTOR_OFFSET
Definition radius.h:33
fr_radius_decode_fail_t
fr_radius_decode_fail_t
Failure reasons.
Definition radius.h:162
DECODE_FAIL_UNKNOWN
@ DECODE_FAIL_UNKNOWN
Definition radius.h:179
DECODE_FAIL_NONE
@ DECODE_FAIL_NONE
Definition radius.h:163
DECODE_FAIL_UNKNOWN_PACKET_CODE
@ DECODE_FAIL_UNKNOWN_PACKET_CODE
Definition radius.h:169
fr_radius_ctx_t::secret
char const * secret
Definition radius.h:95
RADIUS_MAX_PACKET_SIZE
#define RADIUS_MAX_PACKET_SIZE
Definition radius.h:41
fr_radius_ctx_t::secret_length
size_t secret_length
Definition radius.h:96
fr_radius_decode_ctx_t::common
fr_radius_ctx_t const * common
Definition radius.h:125
fr_radius_decode_ctx_t::tmp_ctx
TALLOC_CTX * tmp_ctx
for temporary things cleaned up during decoding
Definition radius.h:129
fr_radius_ctx_t
Definition radius.h:94
fr_radius_decode_ctx_t
Definition radius.h:124
fr_radius_encode_ctx_t
Definition radius.h:103
conf
static rs_t * conf
Definition radsniff.c:53
attr_extended_attribute_1
static fr_dict_attr_t const * attr_extended_attribute_1
Definition radsnmp.c:108
attr_message_authenticator
static fr_dict_attr_t const * attr_message_authenticator
Definition radsnmp.c:112
fr_rand
uint32_t fr_rand(void)
Return a 32-bit random number.
Definition rand.c:105
fr_fast_rand_t
Smaller fast random number generator.
Definition rand.h:54
fr_rb_find
void * fr_rb_find(fr_rb_tree_t const *tree, void const *data)
Find an element in the tree, returning the data, not the node.
Definition rb.c:577
fr_rb_delete
bool fr_rb_delete(fr_rb_tree_t *tree, void const *data)
Remove node and free data (if a free function was specified)
Definition rb.c:741
fr_rb_expire_insert
bool fr_rb_expire_insert(fr_rb_expire_t *expire, void *data, fr_time_t now)
Attempt to find current data in the tree, if it does not exist insert it.
Definition rb_expire.c:39
fr_rb_expire_update
void fr_rb_expire_update(fr_rb_expire_t *expire, void *data, fr_time_t now)
Definition rb_expire.c:55
fr_rb_expire_inline_talloc_init
#define fr_rb_expire_inline_talloc_init(_expire, _type, _field, _data_cmp, _data_free, _lifetime)
Definition rb_expire.h:50
fr_rb_expire_t::head
fr_dlist_head_t head
Definition rb_expire.h:35
fr_rb_expire_node_t::when
fr_time_t when
Definition rb_expire.h:47
fr_rb_expire_t::tree
fr_rb_tree_t tree
Definition rb_expire.h:34
fr_rb_expire_node_t
dlist for expiring old entries
Definition rb_expire.h:44
fr_rb_expire_t
Definition rb_expire.h:33
RETURN_MODULE_RCODE
#define RETURN_MODULE_RCODE(_rcode)
Definition rcode.h:64
rlm_rcode_t
rlm_rcode_t
Return codes indicating the result of the module call.
Definition rcode.h:40
RLM_MODULE_OK
@ RLM_MODULE_OK
The module is OK, continue.
Definition rcode.h:43
RLM_MODULE_FAIL
@ RLM_MODULE_FAIL
Module failed, don't reply.
Definition rcode.h:42
RLM_MODULE_REJECT
@ RLM_MODULE_REJECT
Immediately reject the request.
Definition rcode.h:41
RLM_MODULE_UPDATED
@ RLM_MODULE_UPDATED
OK (pairs modified).
Definition rcode.h:49
RLM_MODULE_HANDLED
@ RLM_MODULE_HANDLED
The module handled the request, so stop.
Definition rcode.h:44
request_local_alloc_external
#define request_local_alloc_external(_ctx, _args)
Allocate a new external request outside of the request pool.
Definition request.h:316
attr_error_cause
static fr_dict_attr_t const * attr_error_cause
Definition rlm_radius.c:192
radius_fixups
static int radius_fixups(rlm_radius_t const *inst, request_t *request)
Do any RADIUS-layer fixups for proxying.
Definition rlm_radius.c:523
attr_nas_identifier
static fr_dict_attr_t const * attr_nas_identifier
Definition rlm_radius.c:197
attr_original_packet_code
static fr_dict_attr_t const * attr_original_packet_code
Definition rlm_radius.c:198
attr_event_timestamp
static fr_dict_attr_t const * attr_event_timestamp
Definition rlm_radius.c:193
attr_response_length
static fr_dict_attr_t const * attr_response_length
Definition rlm_radius.c:199
rlm_radius_s::revive_interval
fr_time_delta_t revive_interval
Definition rlm_radius.h:60
rlm_radius_s::retry
fr_retry_config_t retry[FR_RADIUS_CODE_MAX]
Definition rlm_radius.h:92
rlm_radius_s::name
char const * name
Definition rlm_radius.h:56
rlm_radius_s::status_check
uint32_t status_check
code of status-check type
Definition rlm_radius.h:84
rlm_radius_s::mode
rlm_radius_mode_t mode
proxy, client, etc.
Definition rlm_radius.h:76
RLM_RADIUS_MODE_XLAT_PROXY
@ RLM_RADIUS_MODE_XLAT_PROXY
Definition rlm_radius.h:47
RLM_RADIUS_MODE_INVALID
@ RLM_RADIUS_MODE_INVALID
Definition rlm_radius.h:42
RLM_RADIUS_MODE_PROXY
@ RLM_RADIUS_MODE_PROXY
Definition rlm_radius.h:43
RLM_RADIUS_MODE_REPLICATE
@ RLM_RADIUS_MODE_REPLICATE
Definition rlm_radius.h:45
RLM_RADIUS_MODE_UNCONNECTED_REPLICATE
@ RLM_RADIUS_MODE_UNCONNECTED_REPLICATE
Definition rlm_radius.h:46
RLM_RADIUS_MODE_CLIENT
@ RLM_RADIUS_MODE_CLIENT
Definition rlm_radius.h:44
rlm_radius_s::max_packet_size
uint32_t max_packet_size
Maximum packet size.
Definition rlm_radius.h:66
rlm_radius_s::response_window
fr_time_delta_t response_window
Definition rlm_radius.h:58
rlm_radius_s::max_attributes
uint32_t max_attributes
Maximum number of attributes to decode in response.
Definition rlm_radius.h:78
rlm_radius_s::zombie_period
fr_time_delta_t zombie_period
Definition rlm_radius.h:59
rlm_radius_s
Definition rlm_radius.h:53
retry_config
static conf_parser_t retry_config[]
Definition rlm_tacacs.c:38
fr_schedule_worker_id
int fr_schedule_worker_id(void)
Return the worker id for the current thread.
Definition schedule.c:157
connection_signal_reconnect
void connection_signal_reconnect(connection_t *conn, connection_reason_t reason)
Asynchronously signal the connection should be reconnected.
Definition connection.c:1170
connection_signal_on_fd
int connection_signal_on_fd(connection_t *conn, int fd)
Setup the connection to change states to connected or failed based on I/O events.
Definition connection.c:1408
connection_alloc
connection_t * connection_alloc(TALLOC_CTX *ctx, fr_event_list_t *el, connection_funcs_t const *funcs, connection_conf_t const *conf, char const *log_prefix, void const *uctx)
Allocate a new connection.
Definition connection.c:1515
connection_signal_connected
void connection_signal_connected(connection_t *conn)
Asynchronously signal that the connection is open.
Definition connection.c:1140
connection_s
Definition connection.c:90
module_instance_s::data
void * data
Module's instance data.
Definition module.h:271
pair_append_request
#define pair_append_request(_attr, _da)
Allocate and append a fr_pair_t to the request list.
Definition pair.h:37
fr_signal_t
fr_signal_t
Signals that can be generated/processed by request signal handlers.
Definition signal.h:38
FR_SIGNAL_DUP
@ FR_SIGNAL_DUP
A duplicate request was received.
Definition signal.h:44
FR_SIGNAL_CANCEL
@ FR_SIGNAL_CANCEL
Request has been cancelled.
Definition signal.h:40
inst
eap_aka_sim_process_conf_t * inst
Definition state_machine.c:3620
vp
fr_pair_t * vp
Definition state_machine.c:2262
eap_aka_sim_process_conf_t::type
eap_type_t type
The preferred EAP-Type of this instance of the EAP-SIM/AKA/AKA' state machine.
Definition state_machine.h:188
fr_time
#define fr_time()
Allow us to arbitrarily manipulate time.
Definition state_test.c:8
fr_log_s
Definition log.h:96
map_s
Value pair map.
Definition map.h:77
pair_list_s
Definition pair.h:52
value_pair_s
Stores an attribute, a value and various bits of other data.
Definition pair.h:68
fr_syserror
char const * fr_syserror(int num)
Guaranteed to be thread-safe version of strerror.
Definition syserror.c:243
talloc_get_type_abort_const
#define talloc_get_type_abort_const
Definition talloc.h:282
talloc_const_free
static int talloc_const_free(void const *ptr)
Free const'd memory.
Definition talloc.h:224
fr_time_gteq
#define fr_time_gteq(_a, _b)
Definition time.h:238
fr_time_unwrap
static int64_t fr_time_unwrap(fr_time_t time)
Definition time.h:146
fr_time_wrap
#define fr_time_wrap(_time)
Definition time.h:145
fr_time_lteq
#define fr_time_lteq(_a, _b)
Definition time.h:240
fr_time_eq
#define fr_time_eq(_a, _b)
Definition time.h:241
fr_time_add
#define fr_time_add(_a, _b)
Add a time/time delta together.
Definition time.h:196
fr_time_gt
#define fr_time_gt(_a, _b)
Definition time.h:237
fr_time_sub
#define fr_time_sub(_a, _b)
Subtract one time from another.
Definition time.h:229
fr_time_to_unix_time
static fr_unix_time_t fr_time_to_unix_time(fr_time_t when)
Convert an fr_time_t (internal time) to our version of unix time (wallclock time)
Definition time.h:688
fr_time_lt
#define fr_time_lt(_a, _b)
Definition time.h:239
fr_time_s
"server local" time.
Definition time.h:69
radius_track_state_log
void radius_track_state_log(fr_log_t const *log, fr_log_type_t log_type, char const *file, int line, radius_track_t *tt, radius_track_log_extra_t extra)
Print out the state of every tracking entry.
Definition track.c:294
radius_track_entry_update
int radius_track_entry_update(radius_track_entry_t *te, uint8_t const *vector)
Update a tracking entry with the authentication vector.
Definition track.c:219
radius_track_entry_find
radius_track_entry_t * radius_track_entry_find(radius_track_t *tt, uint8_t packet_id, uint8_t const *vector)
Find a tracking entry from a request authenticator.
Definition track.c:248
radius_track_alloc
radius_track_t * radius_track_alloc(TALLOC_CTX *ctx)
Create an radius_track_t.
Definition track.c:41
radius_track_entry_release
#define radius_track_entry_release(_te)
Definition track.h:90
radius_track_entry_s::uctx
void * uctx
Result/resumption context.
Definition track.h:47
radius_track_entry_s::id
uint8_t id
our ID
Definition track.h:50
radius_track_s::num_requests
unsigned int num_requests
number of requests in the allocation
Definition track.h:65
radius_track_entry_reserve
#define radius_track_entry_reserve(_te_out, _ctx, _tt, _request, _code, _uctx)
Definition track.h:82
radius_track_entry_s::request
request_t * request
as always...
Definition track.h:45
radius_track_entry_s
Track one request to a response.
Definition track.h:36
radius_track_s
Definition track.h:64
trunk_connection_callback_readable
void trunk_connection_callback_readable(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
Standard I/O read function.
Definition trunk.c:4014
trunk_connection_callback_writable
void trunk_connection_callback_writable(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
Standard I/O write function.
Definition trunk.c:4031
trunk_request_signal_partial
void trunk_request_signal_partial(trunk_request_t *treq)
Signal a partial write.
Definition trunk.c:2029
trunk_request_signal_fail
void trunk_request_signal_fail(trunk_request_t *treq)
Signal that a trunk request failed.
Definition trunk.c:2132
trunk_request_alloc
trunk_request_t * trunk_request_alloc(trunk_t *trunk, request_t *request)
(Pre-)Allocate a new trunk request
Definition trunk.c:2474
trunk_alloc
trunk_t * trunk_alloc(TALLOC_CTX *ctx, fr_event_list_t *el, trunk_io_funcs_t const *funcs, trunk_conf_t const *conf, char const *log_prefix, void const *uctx, bool delay_start)
Allocate a new collection of connections.
Definition trunk.c:4945
trunk_connection_requests_requeue
uint64_t trunk_connection_requests_requeue(trunk_connection_t *tconn, int states, uint64_t max, bool fail_bound)
Move requests off of a connection and requeue elsewhere.
Definition trunk.c:2010
trunk_request_enqueue_on_conn
trunk_enqueue_t trunk_request_enqueue_on_conn(trunk_request_t **treq_out, trunk_connection_t *tconn, request_t *request, void *preq, void *rctx, bool ignore_limits)
Enqueue additional requests on a specific connection.
Definition trunk.c:2741
trunk_request_enqueue
trunk_enqueue_t trunk_request_enqueue(trunk_request_t **treq_out, trunk_t *trunk, request_t *request, void *preq, void *rctx)
Enqueue a request that needs data written to the trunk.
Definition trunk.c:2587
trunk_request_requeue
trunk_enqueue_t trunk_request_requeue(trunk_request_t *treq)
Re-enqueue a request on the same connection.
Definition trunk.c:2676
trunk_connection_pop_request
int trunk_connection_pop_request(trunk_request_t **treq_out, trunk_connection_t *tconn)
Pop a request off a connection's pending queue.
Definition trunk.c:3883
trunk_request_signal_cancel
void trunk_request_signal_cancel(trunk_request_t *treq)
Cancel a trunk request.
Definition trunk.c:2152
trunk_request_free
void trunk_request_free(trunk_request_t **treq_to_free)
If the trunk request is freed then update the target requests.
Definition trunk.c:2322
trunk_connection_signal_active
void trunk_connection_signal_active(trunk_connection_t *tconn)
Signal a trunk connection is no longer full.
Definition trunk.c:3960
trunk_connection_signal_inactive
void trunk_connection_signal_inactive(trunk_connection_t *tconn)
Signal a trunk connection cannot accept more requests.
Definition trunk.c:3937
trunk_request_signal_sent
void trunk_request_signal_sent(trunk_request_t *treq)
Signal that the request was written to a connection successfully.
Definition trunk.c:2050
trunk_request_signal_complete
void trunk_request_signal_complete(trunk_request_t *treq)
Signal that a trunk request is complete.
Definition trunk.c:2094
trunk_connection_signal_reconnect
void trunk_connection_signal_reconnect(trunk_connection_t *tconn, connection_reason_t reason)
Signal a trunk connection is no longer viable.
Definition trunk.c:3999
trunk_request_state_log
void trunk_request_state_log(fr_log_t const *log, fr_log_type_t log_type, char const *file, int line, trunk_request_t const *treq)
Definition trunk.c:2828
trunk_connection_s
Associates request queues with a connection.
Definition trunk.c:134
trunk_request_s
Wraps a normal request.
Definition trunk.c:100
trunk_s
Main trunk management handle.
Definition trunk.c:198
TRUNK_REQUEST_STATE_ALL
#define TRUNK_REQUEST_STATE_ALL
All request states.
Definition trunk.h:195
trunk_io_funcs_t::connection_alloc
trunk_connection_alloc_t connection_alloc
Allocate a new connection_t.
Definition trunk.h:733
trunk_connection_event_t
trunk_connection_event_t
What type of I/O events the trunk connection is currently interested in receiving.
Definition trunk.h:72
TRUNK_CONN_EVENT_BOTH
@ TRUNK_CONN_EVENT_BOTH
Trunk should be notified if a connection is readable or writable.
Definition trunk.h:79
TRUNK_CONN_EVENT_WRITE
@ TRUNK_CONN_EVENT_WRITE
Trunk should be notified if a connection is writable.
Definition trunk.h:77
TRUNK_CONN_EVENT_NONE
@ TRUNK_CONN_EVENT_NONE
Don't notify the trunk on connection state changes.
Definition trunk.h:73
TRUNK_CONN_EVENT_READ
@ TRUNK_CONN_EVENT_READ
Trunk should be notified if a connection is readable.
Definition trunk.h:75
trunk_cancel_reason_t
trunk_cancel_reason_t
Reasons for a request being cancelled.
Definition trunk.h:55
TRUNK_CANCEL_REASON_REQUEUE
@ TRUNK_CANCEL_REASON_REQUEUE
A previously sent request is being requeued.
Definition trunk.h:59
TRUNK_ENQUEUE_DST_UNAVAILABLE
@ TRUNK_ENQUEUE_DST_UNAVAILABLE
Destination is down.
Definition trunk.h:153
TRUNK_ENQUEUE_FAIL
@ TRUNK_ENQUEUE_FAIL
General failure.
Definition trunk.h:154
TRUNK_ENQUEUE_OK
@ TRUNK_ENQUEUE_OK
Operation was successful.
Definition trunk.h:150
TRUNK_ENQUEUE_NO_CAPACITY
@ TRUNK_ENQUEUE_NO_CAPACITY
At maximum number of connections, and no connection has capacity.
Definition trunk.h:151
TRUNK_ENQUEUE_IN_BACKLOG
@ TRUNK_ENQUEUE_IN_BACKLOG
Request should be enqueued in backlog.
Definition trunk.h:149
trunk_request_state_t
trunk_request_state_t
Used for sanity checks and to simplify freeing.
Definition trunk.h:161
TRUNK_REQUEST_STATE_PARTIAL
@ TRUNK_REQUEST_STATE_PARTIAL
Some of the request was written to the socket, more of it should be written later.
Definition trunk.h:170
TRUNK_REQUEST_STATE_REAPABLE
@ TRUNK_REQUEST_STATE_REAPABLE
Request has been written, needs to persist, but we are not currently waiting for any response.
Definition trunk.h:173
TRUNK_REQUEST_STATE_UNASSIGNED
@ TRUNK_REQUEST_STATE_UNASSIGNED
Transition state - Request currently not assigned to any connection.
Definition trunk.h:165
TRUNK_REQUEST_STATE_INIT
@ TRUNK_REQUEST_STATE_INIT
Initial state.
Definition trunk.h:162
TRUNK_REQUEST_STATE_CANCEL_SENT
@ TRUNK_REQUEST_STATE_CANCEL_SENT
We've informed the remote server that the request has been cancelled.
Definition trunk.h:185
TRUNK_REQUEST_STATE_COMPLETE
@ TRUNK_REQUEST_STATE_COMPLETE
The request is complete.
Definition trunk.h:182
TRUNK_REQUEST_STATE_FAILED
@ TRUNK_REQUEST_STATE_FAILED
The request failed.
Definition trunk.h:183
TRUNK_REQUEST_STATE_CANCEL
@ TRUNK_REQUEST_STATE_CANCEL
A request on a particular socket was cancel.
Definition trunk.h:184
TRUNK_REQUEST_STATE_CANCEL_PARTIAL
@ TRUNK_REQUEST_STATE_CANCEL_PARTIAL
We partially wrote a cancellation request.
Definition trunk.h:187
TRUNK_REQUEST_STATE_BACKLOG
@ TRUNK_REQUEST_STATE_BACKLOG
In the backlog.
Definition trunk.h:167
TRUNK_REQUEST_STATE_CANCEL_COMPLETE
@ TRUNK_REQUEST_STATE_CANCEL_COMPLETE
Remote server has acknowledged our cancellation.
Definition trunk.h:188
TRUNK_REQUEST_STATE_PENDING
@ TRUNK_REQUEST_STATE_PENDING
In the queue of a connection and is pending writing.
Definition trunk.h:168
TRUNK_REQUEST_STATE_SENT
@ TRUNK_REQUEST_STATE_SENT
Was written to a socket. Waiting for a response.
Definition trunk.h:172
trunk_io_funcs_t
I/O functions to pass to trunk_alloc.
Definition trunk.h:732
el
static fr_event_list_t * el
Definition unit_test_attribute.c:279
unlang_xlat_yield_to_retry
xlat_action_t unlang_xlat_yield_to_retry(request_t *request, xlat_func_t resume, fr_unlang_xlat_retry_t retry, xlat_func_signal_t signal, fr_signal_t sigmask, void *rctx, fr_retry_config_t const *retry_cfg)
Yield a request back to the interpreter, with retries.
Definition xlat.c:691
xlat_arg_parser_t::required
bool required
Argument must be present, and non-empty.
Definition xlat.h:148
XLAT_ARGS
#define XLAT_ARGS(_list,...)
Populate local variables with value boxes from the input list.
Definition xlat.h:381
XLAT_ARG_PARSER_TERMINATOR
#define XLAT_ARG_PARSER_TERMINATOR
Definition xlat.h:168
xlat_action_t
xlat_action_t
Definition xlat.h:37
XLAT_ACTION_FAIL
@ XLAT_ACTION_FAIL
An xlat function failed.
Definition xlat.h:44
XLAT_ACTION_DONE
@ XLAT_ACTION_DONE
We're done evaluating this level of nesting.
Definition xlat.h:43
xlat_arg_parser_t
Definition for a single argument consumend by an xlat function.
Definition xlat.h:147
fr_pair_list_empty
bool fr_pair_list_empty(fr_pair_list_t const *list)
Is a valuepair list empty.
Definition pair_inline.c:125
fr_pair_list_free
void fr_pair_list_free(fr_pair_list_t *list)
Free memory used by a valuepair list.
Definition pair_inline.c:113
fr_pair_list_append
void fr_pair_list_append(fr_pair_list_t *dst, fr_pair_list_t *src)
Appends a list of fr_pair_t from a temporary list to a destination list.
Definition pair_inline.c:182
fr_retry_next
fr_retry_state_t fr_retry_next(fr_retry_t *r, fr_time_t now)
Initialize a retransmission counter.
Definition retry.c:108
fr_retry_init
void fr_retry_init(fr_retry_t *r, fr_time_t now, fr_retry_config_t const *config)
Initialize a retransmission counter.
Definition retry.c:36
fr_retry_t::start
fr_time_t start
when we started the retransmission
Definition retry.h:53
fr_retry_t::rt
fr_time_delta_t rt
retransmit interval
Definition retry.h:57
fr_retry_config_t::mrc
uint32_t mrc
Maximum retransmission count.
Definition retry.h:36
fr_retry_t::config
fr_retry_config_t const * config
master configuration
Definition retry.h:52
fr_retry_t::state
fr_retry_state_t state
so callers can see what state it's in.
Definition retry.h:60
FR_RETRY_MRC
@ FR_RETRY_MRC
reached maximum retransmission count
Definition retry.h:47
FR_RETRY_CONTINUE
@ FR_RETRY_CONTINUE
Definition retry.h:46
FR_RETRY_MRD
@ FR_RETRY_MRD
reached maximum retransmission duration
Definition retry.h:48
fr_retry_t::count
uint32_t count
number of sent packets
Definition retry.h:58
fr_retry_config_t::mrd
fr_time_delta_t mrd
Maximum retransmission duration.
Definition retry.h:35
fr_retry_t::updated
fr_time_t updated
last update, really a cached "now".
Definition retry.h:56
fr_retry_t::next
fr_time_t next
when the next timer should be set
Definition retry.h:55
fr_retry_config_t
Definition retry.h:32
fr_retry_t
Definition retry.h:51
fr_socket_t::af
int af
AF_INET, AF_INET6, or AF_UNIX.
Definition socket.h:78
fr_socket_t::fd
int fd
File descriptor if this is a live socket.
Definition socket.h:81
fr_strerror
char const * fr_strerror(void)
Get the last library error.
Definition strerror.c:554
fr_value_box_alloc
#define fr_value_box_alloc(_ctx, _type, _enumv)
Allocate a value box of a specific type.
Definition value.h:621
data
static fr_slen_t data
Definition value.h:1265
fr_box_time_delta
#define fr_box_time_delta(_val)
Definition value.h:343
nonnull
int nonnull(2, 5))
out
static size_t char ** out
Definition value.h:997
xlat_ctx_s::rctx
void * rctx
Resume context.
Definition xlat_ctx.h:54
xlat_ctx_s::mctx
module_ctx_t const * mctx
Synthesised module calling ctx.
Definition xlat_ctx.h:52
xlat_ctx_s
An xlat calling ctx.
Definition xlat_ctx.h:49
Generated by   doxygen 1.9.8