The FreeRADIUS server $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
Loading...
Searching...
No Matches
bio.c
Go to the documentation of this file.
1/*
2 * This program is is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License as published by
4 * the Free Software Foundation; either version 2 of the License, or (at
5 * your option) any later version.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
15 */
16
17/**
18 * $Id: 46dd4535588452bc3cf25bbe5bf03875d90bc1c6 $
19 * @file src/modules/rlm_radius/bio.c
20 * @brief RADIUS BIO transport
21 *
22 * @copyright 2017 Network RADIUS SAS
23 * @copyright 2020 Arran Cudbard-Bell (a.cudbardb@freeradius.org)
24 */
25
26#include <freeradius-devel/io/application.h>
27#include <freeradius-devel/io/listen.h>
28#include <freeradius-devel/io/pair.h>
29#include <freeradius-devel/missing.h>
30#include <freeradius-devel/server/connection.h>
31#include <freeradius-devel/util/debug.h>
32#include <freeradius-devel/util/heap.h>
33#include <freeradius-devel/util/rb_expire.h>
34
35#include <sys/socket.h>
36
37//#include "rlm_radius.h"
38#include "track.h"
39
40typedef enum {
41 LIMIT_PORTS_NONE = 0, //!< Source port not restricted
42 LIMIT_PORTS_STATIC, //!< Limited source ports for static home servers
43 LIMIT_PORTS_DYNAMIC //!< Limited source ports for dynamic home servers
44} bio_limit_ports_t;
45
46typedef struct {
47 char const *module_name; //!< the module that opened the connection
48 rlm_radius_t const *inst; //!< our instance
49 fr_event_list_t *el; //!< Event list.
50 trunk_t *trunk; //!< trunk handler
51 fr_bio_fd_config_t fd_config; //!< for threads or sockets
52 fr_bio_fd_info_t const *fd_info; //!< status of the FD.
53 fr_radius_ctx_t radius_ctx; //!< for signing packets
54 bio_limit_ports_t limit_source_ports; //!< What type of port limit is in use.
55} bio_handle_ctx_t;
56
57typedef struct {
58 bio_handle_ctx_t ctx; //!< common struct for home servers and BIO handles
59
60 struct {
61 fr_bio_t *fd; //!< writing
62 uint32_t id; //!< for replication
63 fr_rb_expire_t expires; //!< for proxying / client sending
64 } bio;
65
66 int num_ports;
67 connection_t **connections;
68} bio_thread_t;
69
70typedef struct bio_request_s bio_request_t;
71
72/** Track the handle, which is tightly correlated with the FD
73 *
74 */
75typedef struct {
76 bio_handle_ctx_t ctx; //!< common struct for home servers and BIO handles
77
78 int fd; //!< File descriptor.
79
80 struct {
81 fr_bio_t *main; //!< what we use for IO
82 fr_bio_t *fd; //!< raw FD
83 fr_bio_t *mem; //!< memory wrappers for stream sockets
84 } bio;
85
86 connection_t *conn;
87
88 uint8_t last_id; //!< Used when replicating to ensure IDs are distributed
89 ///< evenly.
90
91 uint32_t max_packet_size; //!< Our max packet size. may be different from the parent.
92
93 uint8_t *buffer; //!< Receive buffer.
94 size_t buflen; //!< Receive buffer length.
95
96 radius_track_t *tt; //!< RADIUS ID tracking structure.
97
98 fr_time_t mrs_time; //!< Most recent sent time which had a reply.
99 fr_time_t last_reply; //!< When we last received a reply.
100 fr_time_t first_sent; //!< first time we sent a packet since going idle
101 fr_time_t last_sent; //!< last time we sent a packet.
102 fr_time_t last_idle; //!< last time we had nothing to do
103
104 fr_timer_t *zombie_ev; //!< Zombie timeout.
105
106 bool status_checking; //!< whether we're doing status checks
107 bio_request_t *status_u; //!< for sending status check packets
108 request_t *status_request;
109} bio_handle_t;
110
111
112/** Connect request_t to local tracking structure
113 *
114 */
115struct bio_request_s {
116 trunk_request_t *treq;
117 rlm_rcode_t rcode; //!< from the transport
118 bool is_retry;
119
120 uint32_t priority; //!< copied from request->async->priority
121 fr_time_t recv_time; //!< copied from request->async->recv_time
122
123 uint32_t num_replies; //!< number of reply packets, sent is in retry.count
124
125 bool status_check; //!< is this packet a status check?
126 bool proxied; //!< is this request being proxied
127
128 fr_pair_list_t extra; //!< VPs for debugging, like Proxy-State.
129
130 uint8_t code; //!< Packet code.
131 uint8_t id; //!< Last ID assigned to this packet.
132 uint8_t *packet; //!< Packet we write to the network.
133 size_t packet_len; //!< Length of the packet.
134 size_t partial; //!< partially sent data
135
136 radius_track_entry_t *rr; //!< ID tracking, resend count, etc.
137 fr_timer_t *ev; //!< timer for retransmissions
138 fr_retry_t retry; //!< retransmission timers
139};
140
141typedef struct {
142 bio_handle_ctx_t ctx; //!< for copying to bio_handle_t
143
144 fr_rb_expire_node_t expire;
145
146 int num_ports;
147 connection_t *connections[]; //!< for tracking outbound connections
148} home_server_t;
149
150
151/** Turn a reply code into a module rcode;
152 *
153 */
169
170static void conn_init_writable(UNUSED fr_event_list_t *el, UNUSED int fd,
171 UNUSED int flags, void *uctx);
172
173static int encode(bio_handle_t *h, request_t *request, bio_request_t *u, uint8_t id);
174
175static fr_radius_decode_fail_t decode(TALLOC_CTX *ctx, fr_pair_list_t *reply, uint8_t *response_code,
176 bio_handle_t *h, request_t *request, bio_request_t *u,
177 uint8_t const request_authenticator[static RADIUS_AUTH_VECTOR_LENGTH],
178 uint8_t *data, size_t data_len);
179
180static void protocol_error_reply(bio_request_t *u, bio_handle_t *h);
181
182static void mod_write(request_t *request, trunk_request_t *treq, bio_handle_t *h);
183
184static int _bio_request_free(bio_request_t *u);
185
186static int8_t home_server_cmp(void const *one, void const *two);
187
188#ifndef NDEBUG
189/** Log additional information about a tracking entry
190 *
191 * @param[in] te Tracking entry we're logging information for.
192 * @param[in] log destination.
193 * @param[in] log_type Type of log message.
194 * @param[in] file the logging request was made in.
195 * @param[in] line logging request was made on.
196 */
197static void bio_tracking_entry_log(fr_log_t const *log, fr_log_type_t log_type, char const *file, int line,
198 radius_track_entry_t *te)
199{
200 request_t *request;
201
202 if (!te->request) return; /* Free entry */
203
204 request = talloc_get_type_abort(te->request, request_t);
205
206 fr_log(log, log_type, file, line, "request %s, allocated %s:%d", request->name,
207 request->alloc_file, request->alloc_line);
208
209 trunk_request_state_log(log, log_type, file, line, talloc_get_type_abort(te->uctx, trunk_request_t));
210}
211#endif
212
213/** Clear out any connection specific resources from a udp request
214 *
215 */
216static void bio_request_reset(bio_request_t *u)
217{
218 TALLOC_FREE(u->packet);
219 fr_pair_list_free(&u->extra);
220
221 /*
222 * Can have packet put no u->rr
223 * if this is part of a pre-trunk status check.
224 */
225 if (u->rr) radius_track_entry_release(&u->rr);
226
227 fr_assert(!fr_timer_armed(u->ev));
228}
229
230/** Reset a status_check packet, ready to reuse
231 *
232 */
233static void status_check_reset(bio_handle_t *h, bio_request_t *u)
234{
235 fr_assert(u->status_check == true);
236
237 h->status_checking = false;
238 u->num_replies = 0; /* Reset */
239 u->retry.start = fr_time_wrap(0);
240
241 FR_TIMER_DISARM(u->ev);
242
243 bio_request_reset(u);
244}
245
246/*
247 * Status-Server checks. Manually build the packet, and
248 * all of its associated glue.
249 */
250static void CC_HINT(nonnull) status_check_alloc(bio_handle_t *h)
251{
252 bio_request_t *u;
253 request_t *request;
254 rlm_radius_t const *inst = h->ctx.inst;
255 map_t *map = NULL;
256
257 fr_assert(!h->status_u && !h->status_request);
258
259 MEM(request = request_local_alloc_external(h, (&(request_init_args_t){ .namespace = dict_radius })));
260 MEM(u = talloc_zero(request, bio_request_t));
261 talloc_set_destructor(u, _bio_request_free);
262
263 h->status_u = u;
264
265 h->status_request = request;
266 fr_pair_list_init(&u->extra);
267
268 /*
269 * Status checks are prioritized over any other packet
270 */
271 u->priority = ~(uint32_t) 0;
272 u->status_check = true;
273
274 /*
275 * Allocate outside of the free list.
276 * There appears to be an issue where
277 * the thread destructor runs too
278 * early, and frees the freelist's
279 * head before the module destructor
280 * runs.
281 */
282 request->async = talloc_zero(request, fr_async_t);
283 talloc_const_free(request->name);
284 request->name = talloc_strdup(request, h->ctx.module_name);
285
286 request->packet = fr_packet_alloc(request, false);
287 request->reply = fr_packet_alloc(request, false);
288
289 /*
290 * Create the VPs, and ignore any errors
291 * creating them.
292 */
293 while ((map = map_list_next(&inst->status_check_map, map))) {
294 (void) map_to_request(request, map, map_to_vp, NULL);
295 }
296
297 /*
298 * Ensure that there's a NAS-Identifier, if one wasn't
299 * already added.
300 */
301 if (!fr_pair_find_by_da(&request->request_pairs, NULL, attr_nas_identifier)) {
302 fr_pair_t *vp;
303
304 MEM(pair_append_request(&vp, attr_nas_identifier) >= 0);
305 fr_pair_value_strdup(vp, "status check - are you alive?", false);
306 }
307
308 /*
309 * Always add an Event-Timestamp, which will be the time
310 * at which the first packet is sent. Or for
311 * Status-Server, the time of the current packet.
312 */
313 if (!fr_pair_find_by_da(&request->request_pairs, NULL, attr_event_timestamp)) {
314 MEM(pair_append_request(NULL, attr_event_timestamp) >= 0);
315 }
316
317 /*
318 * Initialize the request IO ctx. Note that we don't set
319 * destructors.
320 */
321 u->code = inst->status_check;
322 request->packet->code = u->code;
323
324 DEBUG3("%s - Status check packet type will be %s", h->ctx.module_name, fr_radius_packet_name[u->code]);
325 log_request_proto_pair_list(L_DBG_LVL_3, request, NULL, &request->request_pairs, NULL);
326}
327
328/** Connection errored
329 *
330 * We were signalled by the event loop that a fatal error occurred on this connection.
331 *
332 * @param[in] el The event list signalling.
333 * @param[in] fd that errored.
334 * @param[in] flags El flags.
335 * @param[in] fd_errno The nature of the error.
336 * @param[in] uctx The trunk connection handle (tconn).
337 */
338static void conn_init_error(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, void *uctx)
339{
340 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
341 bio_handle_t *h;
342
343 /*
344 * Connection must be in the connecting state when this fires
345 */
346 fr_assert(conn->state == CONNECTION_STATE_CONNECTING);
347
348 h = talloc_get_type_abort(conn->h, bio_handle_t);
349
350 ERROR("%s - Connection %s failed: %s", h->ctx.module_name, h->ctx.fd_info->name, fr_syserror(fd_errno));
351
352 connection_signal_reconnect(conn, CONNECTION_FAILED);
353}
354
355/** Status check timer when opening the connection for the first time.
356 *
357 * Setup retries, or fail the connection.
358 */
359static void conn_init_timeout(UNUSED fr_timer_list_t *tl, fr_time_t now, void *uctx)
360{
361 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
362 bio_handle_t *h;
363 bio_request_t *u;
364
365 /*
366 * Connection must be in the connecting state when this fires
367 */
368 fr_assert(conn->state == CONNECTION_STATE_CONNECTING);
369
370 h = talloc_get_type_abort(conn->h, bio_handle_t);
371 u = h->status_u;
372
373 /*
374 * We're only interested in contiguous, good, replies.
375 */
376 u->num_replies = 0;
377
378 switch (fr_retry_next(&u->retry, now)) {
379 case FR_RETRY_MRD:
380 DEBUG("%s - Reached maximum_retransmit_duration (%pVs > %pVs), failing status checks",
381 h->ctx.module_name, fr_box_time_delta(fr_time_sub(now, u->retry.start)),
382 fr_box_time_delta(u->retry.config->mrd));
383 goto fail;
384
385 case FR_RETRY_MRC:
386 DEBUG("%s - Reached maximum_retransmit_count (%u > %u), failing status checks",
387 h->ctx.module_name, u->retry.count, u->retry.config->mrc);
388 fail:
389 connection_signal_reconnect(conn, CONNECTION_FAILED);
390 return;
391
392 case FR_RETRY_CONTINUE:
393 if (fr_event_fd_insert(h, NULL, conn->el, h->fd, conn_init_writable, NULL,
394 conn_init_error, conn) < 0) {
395 PERROR("%s - Failed inserting FD event", h->ctx.module_name);
396 connection_signal_reconnect(conn, CONNECTION_FAILED);
397 }
398 return;
399 }
400
401 fr_assert(0);
402}
403
404/** Perform the next step of init and negotiation.
405 *
406 */
407static void conn_init_next(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
408{
409 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
410 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
411
412 if (fr_event_fd_insert(h, NULL, conn->el, h->fd, conn_init_writable, NULL, conn_init_error, conn) < 0) {
413 PERROR("%s - Failed inserting FD event", h->ctx.module_name);
414 connection_signal_reconnect(conn, CONNECTION_FAILED);
415 }
416}
417
418/** Read the connection during the init and negotiation stage.
419 *
420 */
421static void conn_init_readable(fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
422{
423 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
424 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
425 trunk_t *trunk = h->ctx.trunk;
426 rlm_radius_t const *inst = h->ctx.inst;
427 bio_request_t *u = h->status_u;
428 ssize_t slen;
429 fr_pair_list_t reply;
430 uint8_t code = 0;
431
432 fr_pair_list_init(&reply);
433 slen = fr_bio_read(h->bio.main, NULL, h->buffer, h->buflen);
434 if (slen == 0) {
435 /*
436 * @todo - set BIO FD EOF callback, so that we don't have to check it here.
437 */
438 if (h->ctx.fd_info->eof) goto failed;
439 return;
440 }
441
442 /*
443 * We're done reading, return.
444 */
445 if (slen == fr_bio_error(IO_WOULD_BLOCK)) return;
446
447 if (slen < 0) {
448 switch (errno) {
449 case ECONNREFUSED:
450 ERROR("%s - Failed reading response from socket: there is no server listening on outgoing connection %s",
451 h->ctx.module_name, h->ctx.fd_info->name);
452 break;
453
454 default:
455 ERROR("%s - Failed reading response from socket: %s",
456 h->ctx.module_name, fr_syserror(errno));
457 break;
458 }
459
460 failed:
461 connection_signal_reconnect(conn, CONNECTION_FAILED);
462 return;
463 }
464
465 /*
466 * Where we just return in this function, we're letting
467 * the response timer take care of progressing the
468 * connection attempt.
469 */
470 fr_assert(slen >= RADIUS_HEADER_LENGTH); /* checked in verify */
471
472 if (!u->packet) {
473 ERROR("%s - Received response to expired status check packet",
474 h->ctx.module_name);
475 return;
476 }
477
478 if (u->id != h->buffer[1]) {
479 ERROR("%s - Received response with incorrect or expired ID. Expected %u, got %u",
480 h->ctx.module_name, u->id, h->buffer[1]);
481 return;
482 }
483
484 if (decode(h, &reply, &code,
485 h, h->status_request, h->status_u, u->packet + RADIUS_AUTH_VECTOR_OFFSET,
486 h->buffer, slen) != FR_RADIUS_FAIL_NONE) return;
487
488 fr_pair_list_free(&reply); /* FIXME - Do something with these... */
489
490 /*
491 * Process the error, and count this as a success.
492 * This is usually used for dynamic configuration
493 * on startup.
494 */
495 if (code == FR_RADIUS_CODE_PROTOCOL_ERROR) protocol_error_reply(u, h);
496
497 /*
498 * Last trunk event was a failure, be more careful about
499 * bringing up the connection (require multiple responses).
500 */
501 if ((fr_time_gt(trunk->last_failed, fr_time_wrap(0)) && (fr_time_gt(trunk->last_failed, trunk->last_connected))) &&
502 (u->num_replies < inst->num_answers_to_alive)) {
503 /*
504 * Leave the timer in place. This timer is BOTH when we
505 * give up on the current status check, AND when we send
506 * the next status check.
507 */
508 DEBUG("%s - Received %u / %u replies for status check, on connection - %s",
509 h->ctx.module_name, u->num_replies, inst->num_answers_to_alive, h->ctx.fd_info->name);
510 DEBUG("%s - Next status check packet will be in %pVs",
511 h->ctx.module_name, fr_box_time_delta(fr_time_sub(u->retry.next, fr_time())));
512
513 /*
514 * Set the timer for the next retransmit.
515 */
516 if (fr_timer_at(h, el->tl, &u->ev, u->retry.next, false, conn_init_next, conn) < 0) {
517 connection_signal_reconnect(conn, CONNECTION_FAILED);
518 }
519 return;
520 }
521
522 /*
523 * It's alive!
524 */
525 status_check_reset(h, u);
526
527 DEBUG("%s - Connection open - %s", h->ctx.module_name, h->ctx.fd_info->name);
528
529 connection_signal_connected(conn);
530}
531
532/** Send initial negotiation.
533 *
534 */
535static void conn_init_writable(fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
536{
537 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
538 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
539 bio_request_t *u = h->status_u;
540 ssize_t slen;
541
542 if (fr_time_eq(u->retry.start, fr_time_wrap(0))) {
543 u->id = fr_rand() & 0xff; /* We don't care what the value is here */
544 h->status_checking = true; /* Ensure this is valid */
545 fr_retry_init(&u->retry, fr_time(), &h->ctx.inst->retry[u->code]);
546
547 /*
548 * Status checks can never be retransmitted
549 * So increment the ID here.
550 */
551 } else {
552 bio_request_reset(u);
553 u->id++;
554 }
555
556 DEBUG("%s - Sending %s ID %d over connection %s",
557 h->ctx.module_name, fr_radius_packet_name[u->code], u->id, h->ctx.fd_info->name);
558
559 if (encode(h, h->status_request, u, u->id) < 0) {
560 fail:
561 connection_signal_reconnect(conn, CONNECTION_FAILED);
562 return;
563 }
564 DEBUG3("Encoded packet");
565 HEXDUMP3(u->packet, u->packet_len, NULL);
566
567 fr_assert(u->packet != NULL);
568 fr_assert(u->packet_len >= RADIUS_HEADER_LENGTH);
569
570 slen = fr_bio_write(h->bio.main, NULL, u->packet, u->packet_len);
571
572 if (slen == fr_bio_error(IO_WOULD_BLOCK)) goto blocked;
573
574 if (slen < 0) {
575 ERROR("%s - Failed sending %s ID %d length %zu over connection %s: %s",
576 h->ctx.module_name, fr_radius_packet_name[u->code], u->id, u->packet_len, h->ctx.fd_info->name, fr_syserror(errno));
577
578
579 goto fail;
580 }
581
582 /*
583 * @todo - handle partial packets and blocked writes.
584 */
585 if ((size_t)slen < u->packet_len) {
586 blocked:
587 ERROR("%s - Failed sending %s ID %d length %zu over connection %s: writing is blocked",
588 h->ctx.module_name, fr_radius_packet_name[u->code], u->id, u->packet_len, h->ctx.fd_info->name);
589 goto fail;
590 }
591
592 /*
593 * Switch to waiting on read and insert the event
594 * for the response timeout.
595 */
596 if (fr_event_fd_insert(h, NULL, conn->el, h->fd, conn_init_readable, NULL, conn_init_error, conn) < 0) {
597 PERROR("%s - Failed inserting FD event", h->ctx.module_name);
598 goto fail;
599 }
600
601 DEBUG("%s - %s request. Expecting response within %pVs",
602 h->ctx.module_name, (u->retry.count == 1) ? "Originated" : "Retransmitted",
603 fr_box_time_delta(u->retry.rt));
604
605 if (fr_timer_at(h, el->tl, &u->ev, u->retry.next, false, conn_init_timeout, conn) < 0) {
606 PERROR("%s - Failed inserting timer event", h->ctx.module_name);
607 goto fail;
608 }
609}
610
611/** Free a connection handle, closing associated resources
612 *
613 */
614static int _bio_handle_free(bio_handle_t *h)
615{
616 fr_assert(h != NULL);
617
618 fr_assert(h->fd >= 0);
619
620 if (h->status_u) FR_TIMER_DELETE_RETURN(&h->status_u->ev);
621
622 /*
623 * The connection code will take care of deleting the FD from the event loop.
624 */
625
626 DEBUG("%s - Connection closed - %s", h->ctx.module_name, h->ctx.fd_info->name);
627
628 return 0;
629}
630
631static void bio_connected(fr_bio_t *bio)
632{
633 bio_handle_t *h = bio->uctx;
634
635 DEBUG("%s - Connection open - %s", h->ctx.module_name, h->ctx.fd_info->name);
636
637 connection_signal_connected(h->conn);
638}
639
640static void bio_error(fr_bio_t *bio)
641{
642 bio_handle_t *h = bio->uctx;
643
644 DEBUG("%s - Connection failed - %s - %s", h->ctx.module_name, h->ctx.fd_info->name,
645 fr_syserror(h->ctx.fd_info->connect_errno));
646
647 connection_signal_reconnect(h->conn, CONNECTION_FAILED);
648}
649
650static fr_bio_verify_action_t rlm_radius_verify(UNUSED fr_bio_t *bio, void *verify_ctx, UNUSED void *packet_ctx, const void *data, size_t *size)
651{
652 fr_radius_decode_fail_t failure;
653 size_t in_buffer = *size;
654 bio_handle_t *h = verify_ctx;
655 uint8_t const *hdr = data;
656 size_t want;
657
658 if (in_buffer < 20) {
659 *size = RADIUS_HEADER_LENGTH;
660 return FR_BIO_VERIFY_WANT_MORE;
661 }
662
663 /*
664 * Packet is too large, discard it.
665 */
666 want = fr_nbo_to_uint16(hdr + 2);
667 if (want > h->ctx.inst->max_packet_size) {
668 ERROR("%s - Connection %s received too long packet", h->ctx.module_name, h->ctx.fd_info->name);
669 return FR_BIO_VERIFY_ERROR_CLOSE;
670 }
671
672 /*
673 * Not a full packet, we want more data.
674 */
675 if (want > *size) {
676 *size = want;
677 return FR_BIO_VERIFY_WANT_MORE;
678 }
679
680#define REQUIRE_MA(_h) (((_h)->ctx.inst->require_message_authenticator == FR_RADIUS_REQUIRE_MA_YES) || *(_h)->ctx.inst->received_message_authenticator)
681
682 /*
683 * See if we need to discard the packet.
684 *
685 * @todo - rate limit these messages, and find a way to associate them with a request, or even
686 * the logging destination of the module.
687 */
688 if (!fr_radius_ok(data, size, h->ctx.inst->max_attributes, REQUIRE_MA(h), &failure)) {
689 if (failure == FR_RADIUS_FAIL_UNKNOWN_PACKET_CODE) return FR_BIO_VERIFY_DISCARD;
690
691 PERROR("%s - Connection %s received bad packet", h->ctx.module_name, h->ctx.fd_info->name);
692
693 if (failure == FR_RADIUS_FAIL_MA_MISSING) {
694 if (h->ctx.inst->require_message_authenticator == FR_RADIUS_REQUIRE_MA_YES) {
695 ERROR("We are configured with 'require_message_authenticator = true'");
696 } else {
697 ERROR("We previously received a packet from this client which included a Message-Authenticator attribute");
698 }
699 }
700
701 if (h->ctx.fd_config.socket_type == SOCK_DGRAM) return FR_BIO_VERIFY_DISCARD;
702
703 return FR_BIO_VERIFY_ERROR_CLOSE;
704 }
705
706 /*
707 * @todo - check if the reply is allowed. Bad replies are discarded later, but it might be worth
708 * checking them here.
709 */
710
711 /*
712 * On input, *size is how much data we have. On output, *size is how much data we want.
713 */
714 return (in_buffer >= *size) ? FR_BIO_VERIFY_OK : FR_BIO_VERIFY_WANT_MORE;
715}
716
717
718/** Initialise a new outbound connection
719 *
720 * @param[out] h_out Where to write the new file descriptor.
721 * @param[in] conn to initialise.
722 * @param[in] uctx A #bio_thread_t
723 */
724CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
725static connection_state_t conn_init(void **h_out, connection_t *conn, void *uctx)
726{
727 int fd;
728 bio_handle_t *h;
729 bio_handle_ctx_t *ctx = uctx; /* thread or home server */
730 connection_t **to_save = NULL;
731
732 MEM(h = talloc_zero(conn, bio_handle_t));
733 h->ctx = *ctx;
734 h->conn = conn;
735 h->max_packet_size = h->ctx.inst->max_packet_size;
736 h->last_idle = fr_time();
737
738 MEM(h->buffer = talloc_array(h, uint8_t, h->max_packet_size));
739 h->buflen = h->max_packet_size;
740
741 MEM(h->tt = radius_track_alloc(h));
742
743 /*
744 * We are proxying to multiple home servers, but using a limited port range. We must track the
745 * source port for each home server, so that we only can select the right unused source port for
746 * this home server.
747 */
748 switch (ctx->limit_source_ports) {
749 case LIMIT_PORTS_NONE:
750 break;
751
752 /*
753 * Dynamic home servers store source port usage in the home_server_t
754 */
755 case LIMIT_PORTS_DYNAMIC:
756 {
757 int i;
758 home_server_t *home = talloc_get_type_abort(ctx, home_server_t);
759
760 for (i = 0; i < home->num_ports; i++) {
761 if (!home->connections[i]) {
762 to_save = &home->connections[i];
763
764 /*
765 * Set the source port, but also leave the src_port_start and
766 * src_port_end alone.
767 */
768 h->ctx.fd_config.src_port = h->ctx.fd_config.src_port_start + i;
769 break;
770 }
771 }
772
773 if (!to_save) {
774 ERROR("%s - Failed opening socket to home server %pV:%u - source port range is full",
775 h->ctx.module_name, fr_box_ipaddr(h->ctx.fd_config.dst_ipaddr), h->ctx.fd_config.dst_port);
776 goto fail;
777 }
778 }
779 break;
780
781 /*
782 * Static home servers store source port usage in bio_thread_t
783 */
784 case LIMIT_PORTS_STATIC:
785 {
786 int i;
787 bio_thread_t *thread = talloc_get_type_abort(ctx, bio_thread_t);
788
789 for (i = 0; i < thread->num_ports; i++) {
790 if (!thread->connections[i]) {
791 to_save = &thread->connections[i];
792 h->ctx.fd_config.src_port = h->ctx.fd_config.src_port_start + i;
793 break;
794 }
795 }
796
797 if (!to_save) {
798 ERROR("%s - Failed opening socket to home server %pV:%u - source port range is full",
799 h->ctx.module_name, fr_box_ipaddr(h->ctx.fd_config.dst_ipaddr), h->ctx.fd_config.dst_port);
800 goto fail;
801 }
802 }
803 break;
804 }
805
806 h->bio.fd = fr_bio_fd_alloc(h, &h->ctx.fd_config, 0);
807 if (!h->bio.fd) {
808 PERROR("%s - failed opening socket", h->ctx.module_name);
809 fail:
810 talloc_free(h);
811 return CONNECTION_STATE_FAILED;
812 }
813
814 h->bio.fd->uctx = h;
815 h->ctx.fd_info = fr_bio_fd_info(h->bio.fd);
816
817 fd = h->ctx.fd_info->socket.fd;
818 fr_assert(fd >= 0);
819
820 /*
821 * Create a memory BIO for stream sockets. We want to return only complete packets, and not
822 * partial packets.
823 *
824 * @todo - maybe we want to have a fr_bio_verify_t which is independent of fr_bio_mem_t. That
825 * way we don't need a memory BIO for UDP sockets, but we can still add a verification layer for
826 * UDP sockets?
827 */
828 h->bio.mem = fr_bio_mem_alloc(h, (h->ctx.fd_config.socket_type == SOCK_DGRAM) ? 0 : h->ctx.inst->max_packet_size * 4,
829 0, h->bio.fd);
830 if (!h->bio.mem) {
831 PERROR("%s - Failed allocating memory buffer - ", h->ctx.module_name);
832 goto fail;
833 }
834
835 if (fr_bio_mem_set_verify(h->bio.mem, rlm_radius_verify, h, (h->ctx.fd_config.socket_type == SOCK_DGRAM)) < 0) {
836 PERROR("%s - Failed setting validation callback - ", h->ctx.module_name);
837 goto fail;
838 }
839
840 /*
841 * Set the BIO read function to be the memory BIO, which will then call the packet verification
842 * routine.
843 */
844 h->bio.main = h->bio.mem;
845 h->bio.mem->uctx = h;
846
847 h->fd = fd;
848
849 talloc_set_destructor(h, _bio_handle_free);
850
851 /*
852 * If the socket isn't connected, then do that first.
853 */
854 if (h->ctx.fd_info->state != FR_BIO_FD_STATE_OPEN) {
855 int rcode;
856
857 fr_assert(h->ctx.fd_info->state == FR_BIO_FD_STATE_CONNECTING);
858
859 /*
860 * We don't pass timeouts here because the trunk has it's own connection timeouts.
861 */
862 rcode = fr_bio_fd_connect_full(h->bio.fd, conn->el, bio_connected, bio_error, NULL, NULL);
863 if (rcode < 0) goto fail;
864
865 *h_out = h;
866
867 if (rcode == 0) return CONNECTION_STATE_CONNECTING;
868
869 fr_assert(rcode == 1);
870 return CONNECTION_STATE_CONNECTED;
871
872 /*
873 * If we're doing status checks, then we want at least
874 * one positive response before signalling that the
875 * connection is open.
876 *
877 * To do this we install special I/O handlers that
878 * only signal the connection as open once we get a
879 * status-check response.
880 */
881 } if (h->ctx.inst->status_check) {
882 status_check_alloc(h);
883
884 /*
885 * Start status checking.
886 *
887 * If we've had no recent failures we need exactly
888 * one response to bring the connection online,
889 * otherwise we need inst->num_answers_to_alive
890 */
891 if (fr_event_fd_insert(h, NULL, conn->el, h->fd, NULL,
892 conn_init_writable, conn_init_error, conn) < 0) goto fail;
893
894 /*
895 * If we're not doing status-checks, signal the connection
896 * as open as soon as it becomes writable.
897 */
898 } else {
899 connection_signal_on_fd(conn, fd);
900 }
901
902 *h_out = h;
903
904 if (to_save) *to_save = conn;
905
906 return CONNECTION_STATE_CONNECTING;
907}
908
909/** Shutdown/close a file descriptor
910 *
911 */
912static void conn_close(UNUSED fr_event_list_t *el, void *handle, void *uctx)
913{
914 bio_handle_t *h = talloc_get_type_abort(handle, bio_handle_t);
915
916 /*
917 * There's tracking entries still allocated
918 * this is bad, they should have all been
919 * released.
920 */
921 if (h->tt && (h->tt->num_requests != 0)) {
922#ifndef NDEBUG
923 radius_track_state_log(&default_log, L_ERR, __FILE__, __LINE__, h->tt, bio_tracking_entry_log);
924#endif
925 fr_assert_fail("%u tracking entries still allocated at conn close", h->tt->num_requests);
926 }
927
928 /*
929 * We have opened a limited number of outbound source ports. This means that when we close a
930 * port, we have to mark it unused.
931 */
932 switch (h->ctx.limit_source_ports) {
933 case LIMIT_PORTS_NONE:
934 break;
935
936 case LIMIT_PORTS_DYNAMIC:
937 {
938 int offset;
939 home_server_t *home = talloc_get_type_abort(uctx, home_server_t);
940
941 fr_assert(h->ctx.fd_config.src_port >= h->ctx.fd_config.src_port_start);
942 fr_assert(h->ctx.fd_config.src_port < h->ctx.fd_config.src_port_end);
943
944 offset = h->ctx.fd_config.src_port - h->ctx.fd_config.src_port_start;
945 fr_assert(offset < home->num_ports);
946
947 fr_assert(home->connections[offset] == h->conn);
948
949 home->connections[offset] = NULL;
950 }
951 break;
952
953 case LIMIT_PORTS_STATIC:
954 {
955 int offset;
956 bio_thread_t *thread = talloc_get_type_abort(uctx, bio_thread_t);
957
958 fr_assert(h->ctx.fd_config.src_port >= h->ctx.fd_config.src_port_start);
959 fr_assert(h->ctx.fd_config.src_port < h->ctx.fd_config.src_port_end);
960
961 offset = h->ctx.fd_config.src_port - h->ctx.fd_config.src_port_start;
962 fr_assert(offset < thread->num_ports);
963
964 fr_assert(thread->connections[offset] == h->conn);
965
966 thread->connections[offset] = NULL;
967 }
968 break;
969 }
970
971 DEBUG4("Freeing handle %p", handle);
972
973 talloc_free(h);
974}
975
976/** Connection failed
977 *
978 * @param[in] handle of connection that failed.
979 * @param[in] state the connection was in when it failed.
980 * @param[in] uctx UNUSED.
981 */
982static connection_state_t conn_failed(void *handle, connection_state_t state, UNUSED void *uctx)
983{
984 switch (state) {
985 /*
986 * If the connection was connected when it failed,
987 * we need to handle any outstanding packets and
988 * timer events before reconnecting.
989 */
990 case CONNECTION_STATE_CONNECTED:
991 {
992 bio_handle_t *h = talloc_get_type_abort(handle, bio_handle_t); /* h only available if connected */
993
994 /*
995 * Reset the Status-Server checks.
996 */
997 if (h->status_u) FR_TIMER_DISARM(h->status_u->ev);
998 break;
999
1000 default:
1001 break;
1002 }
1003 }
1004
1005 return CONNECTION_STATE_INIT;
1006}
1007
1008CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
1009static connection_t *thread_conn_alloc(trunk_connection_t *tconn, fr_event_list_t *el,
1010 connection_conf_t const *conf,
1011 char const *log_prefix, void *uctx)
1012{
1013 connection_t *conn;
1014 bio_handle_ctx_t *ctx = uctx; /* thread or home server */
1015
1016 conn = connection_alloc(tconn, el,
1017 &(connection_funcs_t){
1018 .init = conn_init,
1019 .close = conn_close,
1020 .failed = conn_failed
1021 },
1022 conf,
1023 log_prefix,
1024 uctx);
1025 if (!conn) {
1026 PERROR("%s - Failed allocating state handler for new connection", ctx->inst->name);
1027 return NULL;
1028 }
1029 ctx->trunk = tconn->trunk;
1030 ctx->module_name = log_prefix;
1031
1032 return conn;
1033}
1034
1035/** Read and discard data
1036 *
1037 */
1038static void conn_discard(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
1039{
1040 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
1041 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1042 uint8_t buffer[4096];
1043 ssize_t slen;
1044
1045 while ((slen = fr_bio_read(h->bio.main, NULL, buffer, sizeof(buffer))) > 0);
1046
1047 if (slen < 0) {
1048 switch (errno) {
1049 case EBADF:
1050 case ECONNRESET:
1051 case ENOTCONN:
1052 case ETIMEDOUT:
1053 ERROR("%s - Failed draining socket: %s", h->ctx.module_name, fr_syserror(errno));
1054 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1055 break;
1056
1057 default:
1058 break;
1059 }
1060 }
1061}
1062
1063/** Connection errored
1064 *
1065 * We were signalled by the event loop that a fatal error occurred on this connection.
1066 *
1067 * @param[in] el The event list signalling.
1068 * @param[in] fd that errored.
1069 * @param[in] flags El flags.
1070 * @param[in] fd_errno The nature of the error.
1071 * @param[in] uctx The trunk connection handle (tconn).
1072 */
1073static void conn_error(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, void *uctx)
1074{
1075 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
1076 connection_t *conn = tconn->conn;
1077 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
1078
1079 if (fd_errno) ERROR("%s - Connection %s failed: %s", h->ctx.module_name, h->ctx.fd_info->name, fr_syserror(fd_errno));
1080
1081 connection_signal_reconnect(conn, CONNECTION_FAILED);
1082}
1083
1084CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
1085static void thread_conn_notify(trunk_connection_t *tconn, connection_t *conn,
1086 fr_event_list_t *el,
1087 trunk_connection_event_t notify_on, UNUSED void *uctx)
1088{
1089 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
1090 fr_event_fd_cb_t read_fn = NULL;
1091 fr_event_fd_cb_t write_fn = NULL;
1092
1093 switch (notify_on) {
1094 /*
1095 * We may have sent multiple requests to the
1096 * other end, so it might be sending us multiple
1097 * replies. We want to drain the socket, instead
1098 * of letting the packets sit in the UDP receive
1099 * queue.
1100 */
1101 case TRUNK_CONN_EVENT_NONE:
1102 read_fn = conn_discard;
1103 break;
1104
1105 case TRUNK_CONN_EVENT_READ:
1106 read_fn = trunk_connection_callback_readable;
1107 break;
1108
1109 case TRUNK_CONN_EVENT_WRITE:
1110 write_fn = trunk_connection_callback_writable;
1111 break;
1112
1113 case TRUNK_CONN_EVENT_BOTH:
1114 read_fn = trunk_connection_callback_readable;
1115 write_fn = trunk_connection_callback_writable;
1116 break;
1117
1118 }
1119
1120 /*
1121 * Over-ride read for replication.
1122 */
1123 if (h->ctx.inst->mode == RLM_RADIUS_MODE_REPLICATE) {
1124 read_fn = conn_discard;
1125
1126 if (fr_bio_fd_write_only(h->bio.fd) < 0) {
1127 PERROR("%s - Failed setting socket to write-only", h->ctx.module_name);
1128 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1129 return;
1130 }
1131 }
1132
1133 if (fr_event_fd_insert(h, NULL, el, h->fd,
1134 read_fn,
1135 write_fn,
1136 conn_error,
1137 tconn) < 0) {
1138 PERROR("%s - Failed inserting FD event", h->ctx.module_name);
1139
1140 /*
1141 * May free the connection!
1142 */
1143 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1144 }
1145}
1146
1147/*
1148 * Return negative numbers to put 'a' at the top of the heap.
1149 * Return positive numbers to put 'b' at the top of the heap.
1150 *
1151 * We want the value with the lowest timestamp to be prioritized at
1152 * the top of the heap.
1153 */
1154static int8_t request_prioritise(void const *one, void const *two)
1155{
1156 bio_request_t const *a = one;
1157 bio_request_t const *b = two;
1158 int8_t ret;
1159
1160 /*
1161 * Prioritise status check packets
1162 */
1163 ret = CMP_PREFER_LARGER(a->status_check, b->status_check);
1164 if (ret != 0) return ret;
1165
1166 /*
1167 * Larger priority is more important.
1168 */
1169 ret = CMP_PREFER_LARGER(a->priority, b->priority);
1170 if (ret != 0) return ret;
1171
1172 /*
1173 * Smaller timestamp (i.e. earlier) is more important.
1174 */
1175 return fr_time_cmp(a->recv_time, b->recv_time);
1176}
1177
1178/** Decode response packet data, extracting relevant information and validating the packet
1179 *
1180 * @param[in] ctx to allocate pairs in.
1181 * @param[out] reply Pointer to head of pair list to add reply attributes to.
1182 * @param[out] response_code The type of response packet.
1183 * @param[in] h connection handle.
1184 * @param[in] request the request.
1185 * @param[in] u UDP request.
1186 * @param[in] request_authenticator from the original request.
1187 * @param[in] data to decode.
1188 * @param[in] data_len Length of input data.
1189 * @return
1190 * - FR_RADIUS_FAIL_NONE on success.
1191 * - FR_RADIUS_FAIL_* on failure.
1192 */
1193static fr_radius_decode_fail_t decode(TALLOC_CTX *ctx, fr_pair_list_t *reply, uint8_t *response_code,
1194 bio_handle_t *h, request_t *request, bio_request_t *u,
1195 uint8_t const request_authenticator[static RADIUS_AUTH_VECTOR_LENGTH],
1196 uint8_t *data, size_t data_len)
1197{
1198 rlm_radius_t const *inst = talloc_get_type_abort_const(h->ctx.inst, rlm_radius_t);
1199 uint8_t code;
1200 fr_radius_decode_ctx_t decode_ctx;
1201
1202 *response_code = 0; /* Initialise to keep the rest of the code happy */
1203
1204 RHEXDUMP3(data, data_len, "Read packet");
1205
1206 decode_ctx = (fr_radius_decode_ctx_t) {
1207 .common = &h->ctx.radius_ctx,
1208 .request_code = u->code,
1209 .request_authenticator = request_authenticator,
1210 .tmp_ctx = talloc(ctx, uint8_t),
1211 .end = data + data_len,
1212 .verify = true,
1213 .require_message_authenticator = REQUIRE_MA(h),
1214 };
1215
1216 if (fr_radius_decode(ctx, reply, data, data_len, &decode_ctx) < 0) {
1217 talloc_free(decode_ctx.tmp_ctx);
1218 RPEDEBUG("Failed reading packet");
1219 return decode_ctx.reason;
1220 }
1221 talloc_free(decode_ctx.tmp_ctx);
1222
1223 code = data[0];
1224
1225 RDEBUG("Received %s ID %d length %zu reply packet on connection %s",
1226 fr_radius_packet_name[code], data[1], data_len, h->ctx.fd_info->name);
1227 log_request_pair_list(L_DBG_LVL_2, request, NULL, reply, NULL);
1228
1229 /*
1230 * This code is for BlastRADIUS mitigation.
1231 *
1232 * The scenario where this applies is where we send Message-Authenticator
1233 * but the home server doesn't support it or require it, in which case
1234 * the response can be manipulated by an attacker.
1235 */
1236 if ((u->code == FR_RADIUS_CODE_ACCESS_REQUEST) &&
1237 (inst->require_message_authenticator == FR_RADIUS_REQUIRE_MA_AUTO) &&
1238 !*(inst->received_message_authenticator) &&
1239 fr_pair_find_by_da(reply, NULL, attr_message_authenticator) &&
1240 !fr_pair_find_by_da(reply, NULL, attr_eap_message)) {
1241 RINFO("Packet contained a valid Message-Authenticator. Setting \"require_message_authenticator = yes\"");
1242 *(inst->received_message_authenticator) = true;
1243 }
1244
1245 *response_code = code;
1246
1247 /*
1248 * Record the fact we've seen a response
1249 */
1250 u->num_replies++;
1251
1252 /*
1253 * Fixup retry times
1254 */
1255 if (fr_time_gt(u->retry.start, h->mrs_time)) h->mrs_time = u->retry.start;
1256
1257 return FR_RADIUS_FAIL_NONE;
1258}
1259
1260static int encode(bio_handle_t *h, request_t *request, bio_request_t *u, uint8_t id)
1261{
1262 ssize_t packet_len;
1263 fr_radius_encode_ctx_t encode_ctx;
1264 rlm_radius_t const *inst = h->ctx.inst;
1265
1266 fr_assert(inst->allowed[u->code]);
1267 fr_assert(!u->packet);
1268
1269 u->packet_len = inst->max_packet_size;
1270 u->packet = h->buffer;
1271
1272 /*
1273 * We should have at minimum 64-byte packets, so don't
1274 * bother doing run-time checks here.
1275 */
1276 fr_assert(u->packet_len >= (size_t) RADIUS_HEADER_LENGTH);
1277
1278 encode_ctx = (fr_radius_encode_ctx_t) {
1279 .common = &h->ctx.radius_ctx,
1280 .rand_ctx = (fr_fast_rand_t) {
1281 .a = fr_rand(),
1282 .b = fr_rand(),
1283 },
1284 .code = u->code,
1285 .id = id,
1286 .add_proxy_state = u->proxied,
1287 };
1288
1289 /*
1290 * If we're sending a status check packet, update any
1291 * necessary timestamps. Also, don't add Proxy-State, as
1292 * we're originating the packet.
1293 */
1294 if (u->status_check) {
1295 fr_pair_t *vp;
1296
1297 vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_event_timestamp);
1298 if (vp) vp->vp_date = fr_time_to_unix_time(u->retry.updated);
1299
1300 encode_ctx.add_proxy_state = false;
1301 }
1302
1303 /*
1304 * Encode it, leaving room for Proxy-State if necessary.
1305 */
1306 packet_len = fr_radius_encode(&FR_DBUFF_TMP(u->packet, u->packet_len),
1307 &request->request_pairs, &encode_ctx);
1308 if (packet_len < 0) {
1309 RPERROR("Failed encoding packet");
1310 return -1;
1311 }
1312
1313 /*
1314 * The encoded packet should NOT over-run the input buffer.
1315 */
1316 fr_assert((size_t) packet_len <= u->packet_len);
1317
1318 /*
1319 * Add Proxy-State to the tail end of the packet.
1320 *
1321 * We need to add it here, and NOT in
1322 * request->request_pairs, because multiple modules
1323 * may be sending the packets at the same time.
1324 */
1325 if (encode_ctx.add_proxy_state) {
1326 fr_pair_t *vp;
1327
1328 MEM(vp = fr_pair_afrom_da(u, attr_proxy_state));
1329 fr_pair_value_memdup(vp, (uint8_t const *) &inst->common_ctx.proxy_state, sizeof(inst->common_ctx.proxy_state), false);
1330 fr_pair_append(&u->extra, vp);
1331 packet_len += 2 + sizeof(inst->common_ctx.proxy_state);
1332 }
1333
1334 /*
1335 * Update our version of the packet length.
1336 */
1337 u->packet_len = packet_len;
1338
1339 /*
1340 * Now that we're done mangling the packet, sign it.
1341 */
1342 if (fr_radius_sign(u->packet, NULL, (uint8_t const *) h->ctx.radius_ctx.secret,
1343 h->ctx.radius_ctx.secret_length) < 0) {
1344 RPERROR("Failed signing packet");
1345 return -1;
1346 }
1347
1348 MEM(u->packet = talloc_memdup(u, h->buffer, packet_len));
1349
1350 return 0;
1351}
1352
1353
1354/** Revive a connection after "revive_interval"
1355 *
1356 */
1357static void revive_timeout(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
1358{
1359 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
1360 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1361
1362 INFO("%s - Reviving connection %s", h->ctx.module_name, h->ctx.fd_info->name);
1363 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1364}
1365
1366/** Mark a connection dead after "zombie_interval"
1367 *
1368 */
1369static void zombie_timeout(fr_timer_list_t *tl, fr_time_t now, void *uctx)
1370{
1371 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
1372 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1373
1374 INFO("%s - No replies during 'zombie_period', marking connection %s as dead", h->ctx.module_name, h->ctx.fd_info->name);
1375
1376 /*
1377 * Don't use this connection, and re-queue all of its
1378 * requests onto other connections.
1379 */
1380 (void) trunk_connection_requests_requeue(tconn, TRUNK_REQUEST_STATE_ALL, 0, false);
1381
1382 /*
1383 * We do have status checks. Try to reconnect the
1384 * connection immediately. If the status checks pass,
1385 * then the connection will be marked "alive"
1386 */
1387 if (h->ctx.inst->status_check) {
1388 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1389 return;
1390 }
1391
1392 /*
1393 * Revive the connection after a time.
1394 */
1395 if (fr_timer_at(h, tl, &h->zombie_ev,
1396 fr_time_add(now, h->ctx.inst->revive_interval), false,
1397 revive_timeout, tconn) < 0) {
1398 ERROR("Failed inserting revive timeout for connection");
1399 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1400 }
1401}
1402
1403
1404/** See if the connection is zombied.
1405 *
1406 * We check for zombie when major events happen:
1407 *
1408 * 1) request hits its final timeout
1409 * 2) request timer hits, and it needs to be retransmitted
1410 * 3) a DUP packet comes in, and the request needs to be retransmitted
1411 * 4) we're sending a packet.
1412 *
1413 * There MIGHT not be retries configured, so we MUST check for zombie
1414 * when any new packet comes in. Similarly, there MIGHT not be new
1415 * packets, but retries are configured, so we have to check there,
1416 * too.
1417 *
1418 * Also, the socket might not be writable for a while. There MIGHT
1419 * be a long time between getting the timer / DUP signal, and the
1420 * request finally being written to the socket. So we need to check
1421 * for zombie at BOTH the timeout and the mux / write function.
1422 *
1423 * @return
1424 * - true if the connection is zombie.
1425 * - false if the connection is not zombie.
1426 */
1427static bool check_for_zombie(fr_event_list_t *el, trunk_connection_t *tconn, fr_time_t now, fr_time_t last_sent)
1428{
1429 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1430
1431 /*
1432 * We're replicating, and don't care about the health of
1433 * the home server, and this function should not be called.
1434 */
1435 fr_assert(h->ctx.inst->mode != RLM_RADIUS_MODE_REPLICATE);
1436
1437 /*
1438 * If we're status checking OR already zombie, don't go to zombie
1439 */
1440 if (h->status_checking || fr_timer_armed(h->zombie_ev)) return true;
1441
1442 if (fr_time_eq(now, fr_time_wrap(0))) now = fr_time();
1443
1444 /*
1445 * We received a reply since this packet was sent, the connection isn't zombie.
1446 */
1447 if (fr_time_gteq(h->last_reply, last_sent)) return false;
1448
1449 /*
1450 * If we've seen ANY response in the allowed window, then the connection is still alive.
1451 */
1452 if ((h->ctx.inst->mode == RLM_RADIUS_MODE_PROXY) && fr_time_gt(last_sent, fr_time_wrap(0)) &&
1453 (fr_time_lt(fr_time_add(last_sent, h->ctx.inst->response_window), now))) return false;
1454
1455 /*
1456 * Stop using it for new requests.
1457 */
1458 WARN("%s - Entering Zombie state - connection %s", h->ctx.module_name, h->ctx.fd_info->name);
1459 trunk_connection_signal_inactive(tconn);
1460
1461 if (h->ctx.inst->status_check) {
1462 h->status_checking = true;
1463
1464 /*
1465 * Queue up the status check packet. It will be sent
1466 * when the connection is writable.
1467 */
1468 h->status_u->retry.start = fr_time_wrap(0);
1469 h->status_u->treq = NULL;
1470
1471 if (trunk_request_enqueue_on_conn(&h->status_u->treq, tconn, h->status_request,
1472 h->status_u, h->status_u, true) != TRUNK_ENQUEUE_OK) {
1473 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1474 }
1475 } else {
1476 if (fr_timer_at(h, el->tl, &h->zombie_ev, fr_time_add(now, h->ctx.inst->zombie_period),
1477 false, zombie_timeout, tconn) < 0) {
1478 ERROR("Failed inserting zombie timeout for connection");
1479 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1480 }
1481 }
1482
1483 return true;
1484}
1485
1486static void mod_dup(request_t *request, bio_request_t *u)
1487{
1488 bio_handle_t *h;
1489
1490 h = talloc_get_type_abort(u->treq->tconn->conn->h, bio_handle_t);
1491
1492 if (h->ctx.fd_config.socket_type != SOCK_DGRAM) {
1493 RDEBUG("Using stream sockets - suppressing retransmission");
1494 return;
1495 }
1496
1497 /*
1498 * Arguably this should never happen for UDP sockets.
1499 */
1500 if (h->ctx.fd_info->write_blocked) {
1501 RDEBUG("IO is blocked - suppressing retransmission");
1502 return;
1503 }
1504 u->is_retry = true;
1505
1506 /*
1507 * We are doing synchronous proxying, retransmit
1508 * the current request on the same connection.
1509 *
1510 * If it's zombie, we still resend it. If the
1511 * connection is dead, then a callback will move
1512 * this request to a new connection.
1513 */
1514 mod_write(request, u->treq, h);
1515}
1516
1517static void do_retry(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_retry_t const *retry);
1518
1519/** Handle module retries.
1520 *
1521 */
1522static void mod_retry(module_ctx_t const *mctx, request_t *request, fr_retry_t const *retry)
1523{
1524 bio_request_t *u = talloc_get_type_abort(mctx->rctx, bio_request_t);
1525 rlm_radius_t const *inst = talloc_get_type_abort(mctx->mi->data, rlm_radius_t);
1526
1527 do_retry(inst, u, request, retry);
1528}
1529
1530static void do_retry(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_retry_t const *retry)
1531{
1532 trunk_request_t *treq;
1533 trunk_connection_t *tconn;
1534 fr_time_t now;
1535
1536 if (!u->treq) {
1537 RDEBUG("Packet was cancelled by the connection handler - ignoring retry");
1538 return;
1539 }
1540
1541 treq = talloc_get_type_abort(u->treq, trunk_request_t);
1542
1543 fr_assert(request == treq->request);
1544 fr_assert(treq->preq); /* Must still have a protocol request */
1545 fr_assert(treq->preq == u);
1546
1547 tconn = treq->tconn;
1548 now = retry->updated;
1549
1550 switch (retry->state) {
1551 case FR_RETRY_CONTINUE:
1552 u->retry = *retry;
1553
1554 switch (treq->state) {
1555 case TRUNK_REQUEST_STATE_INIT:
1556 case TRUNK_REQUEST_STATE_UNASSIGNED:
1557 fr_assert(0);
1558 break;
1559
1560 case TRUNK_REQUEST_STATE_BACKLOG:
1561 RDEBUG("Packet is still in the backlog queue to be sent - suppressing retransmission");
1562 return;
1563
1564 case TRUNK_REQUEST_STATE_PENDING:
1565 RDEBUG("Packet is still in the pending queue to be sent - suppressing retransmission");
1566 return;
1567
1568 case TRUNK_REQUEST_STATE_PARTIAL:
1569 RDEBUG("Packet was partially written, as IO is blocked - suppressing retransmission");
1570 return;
1571
1572 case TRUNK_REQUEST_STATE_SENT:
1573 fr_assert(tconn);
1574
1575 mod_dup(request, u);
1576 return;
1577
1578 case TRUNK_REQUEST_STATE_REAPABLE:
1579 case TRUNK_REQUEST_STATE_COMPLETE:
1580 case TRUNK_REQUEST_STATE_FAILED:
1581 case TRUNK_REQUEST_STATE_CANCEL:
1582 case TRUNK_REQUEST_STATE_CANCEL_SENT:
1583 case TRUNK_REQUEST_STATE_CANCEL_PARTIAL:
1584 case TRUNK_REQUEST_STATE_CANCEL_COMPLETE:
1585 fr_assert(0);
1586 break;
1587 }
1588 break;
1589
1590 case FR_RETRY_MRD:
1591 REDEBUG("Reached maximum_retransmit_duration (%pVs > %pVs), failing request",
1592 fr_box_time_delta(fr_time_sub(now, retry->start)), fr_box_time_delta(retry->config->mrd));
1593 break;
1594
1595 case FR_RETRY_MRC:
1596 REDEBUG("Reached maximum_retransmit_count (%u > %u), failing request",
1597 retry->count, retry->config->mrc);
1598 break;
1599 }
1600
1601 u->rcode = RLM_MODULE_FAIL;
1602 trunk_request_signal_fail(treq);
1603
1604 /*
1605 * We don't do zombie stuff!
1606 */
1607 if (!tconn || (inst->mode == RLM_RADIUS_MODE_REPLICATE)) return;
1608
1609 check_for_zombie(unlang_interpret_event_list(request), tconn, now, retry->start);
1610}
1611
1612CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
1613static void request_mux(UNUSED fr_event_list_t *el,
1614 trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
1615{
1616 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
1617 trunk_request_t *treq;
1618 request_t *request;
1619
1620 if (unlikely(trunk_connection_pop_request(&treq, tconn) < 0)) return;
1621
1622 /*
1623 * No more requests to send
1624 */
1625 if (!treq) return;
1626
1627 request = treq->request;
1628
1629 mod_write(request, treq, h);
1630}
1631
1632static void mod_write(request_t *request, trunk_request_t *treq, bio_handle_t *h)
1633{
1634 rlm_radius_t const *inst = h->ctx.inst;
1635 bio_request_t *u;
1636 char const *action;
1637 uint8_t const *packet;
1638 size_t packet_len;
1639 ssize_t slen;
1640
1641 u = treq->preq;
1642
1643 fr_assert((treq->state == TRUNK_REQUEST_STATE_PENDING) ||
1644 (treq->state == TRUNK_REQUEST_STATE_PARTIAL) ||
1645 ((u->retry.count > 0) && (treq->state == TRUNK_REQUEST_STATE_SENT)));
1646
1647 fr_assert(!u->status_check);
1648
1649 /*
1650 * If it's a partial packet, then write the partial bit.
1651 */
1652 if (u->partial) {
1653 fr_assert(u->partial < u->packet_len);
1654 packet = u->packet + u->partial;
1655 packet_len = u->packet_len - u->partial;
1656 goto do_write;
1657 }
1658
1659 /*
1660 * No previous packet, OR can't retransmit the
1661 * existing one. Oh well.
1662 *
1663 * Note that if we can't retransmit the previous
1664 * packet, then u->rr MUST already have been
1665 * deleted in the request_cancel() function
1666 * or request_release_conn() function when
1667 * the REQUEUE signal was received.
1668 */
1669 if (!u->packet) {
1670 fr_assert(!u->rr);
1671
1672 if (unlikely(radius_track_entry_reserve(&u->rr, treq, h->tt, request, u->code, treq) < 0)) {
1673#ifndef NDEBUG
1674 radius_track_state_log(&default_log, L_ERR, __FILE__, __LINE__,
1675 h->tt, bio_tracking_entry_log);
1676#endif
1677 fr_assert_fail("Tracking entry allocation failed: %s", fr_strerror());
1678 trunk_request_signal_fail(treq);
1679 return;
1680 }
1681 fr_assert(u->rr);
1682 u->id = u->rr->id;
1683
1684 RDEBUG("Sending %s ID %d length %zu over connection %s",
1685 fr_radius_packet_name[u->code], u->id, u->packet_len, h->ctx.fd_info->name);
1686
1687 if (encode(h, request, u, u->id) < 0) {
1688 /*
1689 * Need to do this because request_conn_release
1690 * may not be called.
1691 */
1692 bio_request_reset(u);
1693 trunk_request_signal_fail(treq);
1694 return;
1695 }
1696 RHEXDUMP3(u->packet, u->packet_len, "Encoded packet");
1697
1698 /*
1699 * Remember the authentication vector, which now has the
1700 * packet signature.
1701 */
1702 (void) radius_track_entry_update(u->rr, u->packet + RADIUS_AUTH_VECTOR_OFFSET);
1703 } else {
1704 RDEBUG("Retransmitting %s ID %d length %zu over connection %s",
1705 fr_radius_packet_name[u->code], u->id, u->packet_len, h->ctx.fd_info->name);
1706 }
1707
1708 /*
1709 * @todo - When logging Message-Authenticator, don't print its' value.
1710 */
1711 log_request_proto_pair_list(L_DBG_LVL_2, request, NULL, &request->request_pairs, NULL);
1712 if (!fr_pair_list_empty(&u->extra)) log_request_proto_pair_list(L_DBG_LVL_2, request, NULL, &u->extra, NULL);
1713
1714 packet = u->packet;
1715 packet_len = u->packet_len;
1716
1717do_write:
1718 fr_assert(packet != NULL);
1719 fr_assert(packet_len >= RADIUS_HEADER_LENGTH);
1720
1721 slen = fr_bio_write(h->bio.main, NULL, packet, packet_len);
1722
1723 /*
1724 * Can't write anything, requeue it on a different socket.
1725 */
1726 if (slen == fr_bio_error(IO_WOULD_BLOCK)) goto requeue;
1727
1728 if (slen < 0) {
1729 switch (errno) {
1730 /*
1731 * There is an error in the request.
1732 */
1733 case EMSGSIZE: /* Packet size exceeds max size allowed on socket */
1734 ERROR("%s - Failed sending data over connection %s: %s",
1735 h->ctx.module_name, h->ctx.fd_info->name, fr_syserror(errno));
1736 trunk_request_signal_fail(treq);
1737 break;
1738
1739 /*
1740 * There is an error in the connection. The reconnection will re-queue any pending or
1741 * sent requests, so we don't have to do any cleanup.
1742 */
1743 default:
1744 ERROR("%s - Failed sending data over connection %s: %s",
1745 h->ctx.module_name, h->ctx.fd_info->name, fr_syserror(errno));
1746 trunk_connection_signal_reconnect(treq->tconn, CONNECTION_FAILED);
1747 break;
1748 }
1749
1750 return;
1751 }
1752
1753 /*
1754 * No data to send, ignore the write for partials, but otherwise requeue it.
1755 */
1756 if (slen == 0) {
1757 if (u->partial) return;
1758
1759 requeue:
1760 RWARN("%s - Failed sending data over connection %s: sent zero bytes",
1761 h->ctx.module_name, h->ctx.fd_info->name);
1762 trunk_request_requeue(treq);
1763 return;
1764 }
1765
1766 packet_len += slen;
1767 if (packet_len < u->packet_len) {
1768 u->partial = packet_len;
1769 trunk_request_signal_partial(treq);
1770 return;
1771 }
1772
1773 /*
1774 * For retransmissions.
1775 */
1776 u->partial = 0;
1777
1778 /*
1779 * Don't print anything extra for replication.
1780 */
1781 if (inst->mode == RLM_RADIUS_MODE_REPLICATE) {
1782 u->rcode = RLM_MODULE_OK;
1783 trunk_request_signal_complete(treq);
1784 return;
1785 }
1786
1787 /*
1788 * On first packet, signal it as sent, and update stats.
1789 *
1790 * Later packets are just retransmissions to the BIO, and don't need to involve
1791 * the trunk code.
1792 */
1793 if (u->retry.count == 1) {
1794 h->last_sent = u->retry.start;
1795 if (fr_time_lteq(h->first_sent, h->last_idle)) h->first_sent = h->last_sent;
1796
1797 trunk_request_signal_sent(treq);
1798
1799 action = u->proxied ? "Proxied" : "Originated";
1800
1801 } else {
1802 /*
1803 * We don't signal the trunk that it's been sent, it was already senty
1804 */
1805 action = "Retransmitted";
1806 }
1807
1808 fr_assert(!u->status_check);
1809
1810 if (!u->proxied) {
1811 RDEBUG("%s request. Expecting response within %pVs", action,
1812 fr_box_time_delta(u->retry.rt));
1813
1814 } else {
1815 /*
1816 * If the packet doesn't get a response,
1817 * then bio_request_free() will notice, and run conn_zombie()
1818 */
1819 RDEBUG("%s request. Relying on NAS to perform more retransmissions", action);
1820 }
1821
1822 /*
1823 * We don't retransmit over TCP.
1824 */
1825 if (h->ctx.fd_config.socket_type != SOCK_DGRAM) return;
1826
1827 /*
1828 * If we only send one datagram packet, then don't bother saving it.
1829 */
1830 if (u->retry.config && u->retry.config->mrc == 1) {
1831 u->packet = NULL;
1832 return;
1833 }
1834
1835 MEM(u->packet = talloc_memdup(u, u->packet, u->packet_len));
1836}
1837
1838/** Deal with Protocol-Error replies, and possible negotiation
1839 *
1840 */
1841static void protocol_error_reply(bio_request_t *u, bio_handle_t *h)
1842{
1843 bool error_601 = false;
1844 uint32_t response_length = 0;
1845 uint8_t const *attr, *end;
1846
1847 end = h->buffer + fr_nbo_to_uint16(h->buffer + 2);
1848
1849 for (attr = h->buffer + RADIUS_HEADER_LENGTH;
1850 attr < end;
1851 attr += attr[1]) {
1852 /*
1853 * Error-Cause = Response-Too-Big
1854 */
1855 if ((attr[0] == attr_error_cause->attr) && (attr[1] == 6)) {
1856 uint32_t error;
1857
1858 memcpy(&error, attr + 2, 4);
1859 error = ntohl(error);
1860 if (error == 601) error_601 = true;
1861 continue;
1862 }
1863
1864 /*
1865 * The other end wants us to increase our Response-Length
1866 */
1867 if ((attr[0] == attr_response_length->attr) && (attr[1] == 6)) {
1868 memcpy(&response_length, attr + 2, 4);
1869 continue;
1870 }
1871
1872 /*
1873 * Protocol-Error packets MUST contain an
1874 * Original-Packet-Code attribute.
1875 *
1876 * The attribute containing the
1877 * Original-Packet-Code is an extended
1878 * attribute.
1879 */
1880 if (attr[0] != attr_extended_attribute_1->attr) continue;
1881
1882 /*
1883 * ATTR + LEN + EXT-Attr + uint32
1884 */
1885 if (attr[1] != 7) continue;
1886
1887 /*
1888 * See if there's an Original-Packet-Code.
1889 */
1890 if (attr[2] != (uint8_t)attr_original_packet_code->attr) continue;
1891
1892 /*
1893 * Has to be an 8-bit number.
1894 */
1895 if ((attr[3] != 0) ||
1896 (attr[4] != 0) ||
1897 (attr[5] != 0)) {
1898 u->rcode = RLM_MODULE_FAIL;
1899 return;
1900 }
1901
1902 /*
1903 * The value has to match. We don't
1904 * currently multiplex different codes
1905 * with the same IDs on connections. So
1906 * this check is just for RFC compliance,
1907 * and for sanity.
1908 */
1909 if (attr[6] != u->code) {
1910 u->rcode = RLM_MODULE_FAIL;
1911 return;
1912 }
1913 }
1914
1915 /*
1916 * Error-Cause = Response-Too-Big
1917 *
1918 * The other end says it needs more room to send it's response
1919 *
1920 * Limit it to reasonable values.
1921 */
1922 if (error_601 && response_length && (response_length > h->buflen)) {
1923 if (response_length < 4096) response_length = 4096;
1924 if (response_length > 65535) response_length = 65535;
1925
1926 DEBUG("%s - Increasing buffer size to %u for connection %s", h->ctx.module_name, response_length, h->ctx.fd_info->name);
1927
1928 /*
1929 * Make sure to copy the packet over!
1930 */
1931 attr = h->buffer;
1932 h->buflen = response_length;
1933 MEM(h->buffer = talloc_array(h, uint8_t, h->buflen));
1934
1935 memcpy(h->buffer, attr, end - attr);
1936 }
1937
1938 /*
1939 * fail - something went wrong internally, or with the connection.
1940 * invalid - wrong response to packet
1941 * handled - best remaining alternative :(
1942 *
1943 * i.e. if the response is NOT accept, reject, whatever,
1944 * then we shouldn't allow the caller to do any more
1945 * processing of this packet. There was a protocol
1946 * error, and the response is valid, but not useful for
1947 * anything.
1948 */
1949 u->rcode = RLM_MODULE_HANDLED;
1950}
1951
1952
1953/** Handle retries for a status check
1954 *
1955 */
1956static void status_check_next(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
1957{
1958 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
1959 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1960
1961 if (trunk_request_enqueue_on_conn(&h->status_u->treq, tconn, h->status_request,
1962 h->status_u, h->status_u, true) != TRUNK_ENQUEUE_OK) {
1963 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1964 }
1965}
1966
1967
1968/** Deal with replies replies to status checks and possible negotiation
1969 *
1970 */
1971static void status_check_reply(trunk_request_t *treq, fr_time_t now)
1972{
1973 bio_handle_t *h = talloc_get_type_abort(treq->tconn->conn->h, bio_handle_t);
1974 rlm_radius_t const *inst = h->ctx.inst;
1975 bio_request_t *u = talloc_get_type_abort(treq->rctx, bio_request_t);
1976
1977 fr_assert(treq->preq == h->status_u);
1978 fr_assert(treq->rctx == h->status_u);
1979
1980 u->treq = NULL;
1981
1982 /*
1983 * @todo - do other negotiation and signaling.
1984 */
1985 if (h->buffer[0] == FR_RADIUS_CODE_PROTOCOL_ERROR) protocol_error_reply(u, h);
1986
1987 if (u->num_replies < inst->num_answers_to_alive) {
1988 DEBUG("Received %u / %u replies for status check, on connection - %s",
1989 u->num_replies, inst->num_answers_to_alive, h->ctx.fd_info->name);
1990 DEBUG("Next status check packet will be in %pVs", fr_box_time_delta(fr_time_sub(u->retry.next, now)));
1991
1992 /*
1993 * Set the timer for the next retransmit.
1994 */
1995 if (fr_timer_at(h, h->ctx.el->tl, &u->ev, u->retry.next, false, status_check_next, treq->tconn) < 0) {
1996 trunk_connection_signal_reconnect(treq->tconn, CONNECTION_FAILED);
1997 }
1998 return;
1999 }
2000
2001 DEBUG("Received enough replies to status check, marking connection as active - %s", h->ctx.fd_info->name);
2002
2003 /*
2004 * Set the "last idle" time to now, so that we don't
2005 * restart zombie_period until sufficient time has
2006 * passed.
2007 */
2008 h->last_idle = fr_time();
2009
2010 /*
2011 * Reset retry interval and retransmission counters
2012 * also frees u->ev.
2013 */
2014 status_check_reset(h, u);
2015 trunk_connection_signal_active(treq->tconn);
2016}
2017
2018CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
2019static void request_demux(UNUSED fr_event_list_t *el, trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
2020{
2021 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
2022
2023 DEBUG3("%s - Reading data for connection %s", h->ctx.module_name, h->ctx.fd_info->name);
2024
2025 while (true) {
2026 ssize_t slen;
2027
2028 trunk_request_t *treq;
2029 request_t *request;
2030 bio_request_t *u;
2031 radius_track_entry_t *rr;
2032 fr_radius_decode_fail_t reason;
2033 uint8_t code = 0;
2034 fr_pair_list_t reply;
2035 fr_pair_t *vp;
2036
2037 fr_time_t now;
2038
2039 fr_pair_list_init(&reply);
2040
2041 /*
2042 * Drain the socket of all packets. If we're busy, this
2043 * saves a round through the event loop. If we're not
2044 * busy, a few extra system calls don't matter.
2045 */
2046 slen = fr_bio_read(h->bio.main, NULL, h->buffer, h->buflen);
2047 if (slen == 0) {
2048 /*
2049 * @todo - set BIO FD EOF callback, so that we don't have to check it here.
2050 */
2051 if (h->ctx.fd_info->eof) trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
2052 return;
2053 }
2054
2055 /*
2056 * We're done reading, return.
2057 */
2058 if (slen == fr_bio_error(IO_WOULD_BLOCK)) return;
2059
2060 if (slen < 0) {
2061 ERROR("%s - Failed reading response from socket: %s",
2062 h->ctx.module_name, fr_syserror(errno));
2063 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
2064 return;
2065 }
2066
2067 fr_assert(slen >= RADIUS_HEADER_LENGTH); /* checked in verify */
2068
2069 /*
2070 * Note that we don't care about packet codes. All
2071 * packet codes share the same ID space.
2072 */
2073 rr = radius_track_entry_find(h->tt, h->buffer[1], NULL);
2074 if (!rr) {
2075 WARN("%s - Ignoring reply with ID %i that arrived too late",
2076 h->ctx.module_name, h->buffer[1]);
2077 continue;
2078 }
2079
2080 treq = talloc_get_type_abort(rr->uctx, trunk_request_t);
2081 request = treq->request;
2082 fr_assert(request != NULL);
2083 u = talloc_get_type_abort(treq->rctx, bio_request_t);
2084 fr_assert(u == treq->preq);
2085
2086 /*
2087 * Decode the incoming packet.
2088 */
2089 reason = decode(request->reply_ctx, &reply, &code, h, request, u, rr->vector, h->buffer, (size_t)slen);
2090 if (reason != FR_RADIUS_FAIL_NONE) continue;
2091
2092 /*
2093 * Only valid packets are processed
2094 * Otherwise an attacker could perform
2095 * a DoS attack against the proxying servers
2096 * by sending fake responses for upstream
2097 * servers.
2098 */
2099 h->last_reply = now = fr_time();
2100
2101 /*
2102 * Status-Server can have any reply code, we don't care
2103 * what it is. So long as it's signed properly, we
2104 * accept it. This flexibility is because we don't
2105 * expose Status-Server to the admins. It's only used by
2106 * this module for internal signalling.
2107 */
2108 if (u == h->status_u) {
2109 fr_pair_list_free(&reply); /* Probably want to pass this to status_check_reply? */
2110 status_check_reply(treq, now);
2111 trunk_request_signal_complete(treq);
2112 continue;
2113 }
2114
2115 /*
2116 * Handle any state changes, etc. needed by receiving a
2117 * Protocol-Error reply packet.
2118 *
2119 * Protocol-Error is permitted as a reply to any
2120 * packet.
2121 */
2122 switch (code) {
2123 case FR_RADIUS_CODE_PROTOCOL_ERROR:
2124 protocol_error_reply(u, h);
2125
2126 vp = fr_pair_find_by_da(&request->reply_pairs, NULL, attr_original_packet_code);
2127 if (!vp) {
2128 RWDEBUG("Protocol-Error response is missing Original-Packet-Code");
2129 } else {
2130 fr_pair_delete_by_da(&request->reply_pairs, attr_original_packet_code);
2131 }
2132
2133 vp = fr_pair_find_by_da(&request->reply_pairs, NULL, attr_error_cause);
2134 if (!vp) {
2135 MEM(vp = fr_pair_afrom_da(request->reply_ctx, attr_error_cause));
2136 vp->vp_uint32 = FR_ERROR_CAUSE_VALUE_PROXY_PROCESSING_ERROR;
2137 fr_pair_append(&request->reply_pairs, vp);
2138 }
2139 break;
2140
2141 default:
2142 break;
2143 }
2144
2145 /*
2146 * Mark up the request as being an Access-Challenge, if
2147 * required.
2148 *
2149 * We don't do this for other packet types, because the
2150 * ok/fail nature of the module return code will
2151 * automatically result in it the parent request
2152 * returning an ok/fail packet code.
2153 */
2154 if ((u->code == FR_RADIUS_CODE_ACCESS_REQUEST) && (code == FR_RADIUS_CODE_ACCESS_CHALLENGE)) {
2155 vp = fr_pair_find_by_da(&request->reply_pairs, NULL, attr_packet_type);
2156 if (!vp) {
2157 MEM(vp = fr_pair_afrom_da(request->reply_ctx, attr_packet_type));
2158 vp->vp_uint32 = FR_RADIUS_CODE_ACCESS_CHALLENGE;
2159 fr_pair_append(&request->reply_pairs, vp);
2160 }
2161 }
2162
2163 /*
2164 * Delete Proxy-State attributes from the reply.
2165 */
2166 fr_pair_delete_by_da(&reply, attr_proxy_state);
2167
2168 /*
2169 * If the reply has Message-Authenticator, then over-ride its value with all zeros, so
2170 * that we don't confuse anyone reading the debug output.
2171 */
2172 if ((vp = fr_pair_find_by_da(&reply, NULL, attr_message_authenticator)) != NULL) {
2173 (void) fr_pair_value_memdup(vp, (uint8_t const *) "", 1, false);
2174 }
2175
2176 treq->request->reply->code = code;
2177 u->rcode = radius_code_to_rcode[code];
2178 fr_pair_list_append(&request->reply_pairs, &reply);
2179 trunk_request_signal_complete(treq);
2180 }
2181}
2182
2183/*
2184 * This is the same as request_mux(), except that we immediately mark the request as complete.
2185 */
2186CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
2187static void request_replicate_mux(UNUSED fr_event_list_t *el,
2188 trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
2189{
2190 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
2191 trunk_request_t *treq;
2192
2193 if (unlikely(trunk_connection_pop_request(&treq, tconn) < 0)) return;
2194
2195 /*
2196 * No more requests to send
2197 */
2198 if (!treq) return;
2199
2200 mod_write(treq->request, treq, h);
2201}
2202
2203CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
2204static void request_replicate_demux(UNUSED fr_event_list_t *el, trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
2205{
2206 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
2207
2208 DEBUG3("%s - Reading data for connection %s", h->ctx.module_name, h->ctx.fd_info->name);
2209
2210 while (true) {
2211 ssize_t slen;
2212
2213 trunk_request_t *treq;
2214 request_t *request;
2215 bio_request_t *u;
2216 radius_track_entry_t *rr;
2217 fr_radius_decode_fail_t reason;
2218 uint8_t code = 0;
2219 fr_pair_list_t reply;
2220
2221 fr_time_t now;
2222
2223 fr_pair_list_init(&reply);
2224
2225 /*
2226 * Drain the socket of all packets. If we're busy, this
2227 * saves a round through the event loop. If we're not
2228 * busy, a few extra system calls don't matter.
2229 */
2230 slen = fr_bio_read(h->bio.main, NULL, h->buffer, h->buflen);
2231 if (slen == 0) {
2232 /*
2233 * @todo - set BIO FD EOF callback, so that we don't have to check it here.
2234 */
2235 if (h->ctx.fd_info->eof) trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
2236 return;
2237 }
2238
2239 /*
2240 * We're done reading, return.
2241 */
2242 if (slen == fr_bio_error(IO_WOULD_BLOCK)) return;
2243
2244 if (slen < 0) {
2245 ERROR("%s - Failed reading response from socket: %s",
2246 h->ctx.module_name, fr_syserror(errno));
2247 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
2248 return;
2249 }
2250
2251 fr_assert(slen >= RADIUS_HEADER_LENGTH); /* checked in verify */
2252
2253 /*
2254 * We only pay attention to Protocol-Error replies.
2255 *
2256 * All other packets are discarded.
2257 */
2258 if (h->buffer[0] != FR_RADIUS_CODE_PROTOCOL_ERROR) {
2259 continue;
2260 }
2261
2262 /*
2263 * Note that we don't care about packet codes. All
2264 * packet codes share the same ID space.
2265 */
2266 rr = radius_track_entry_find(h->tt, h->buffer[1], NULL);
2267 if (!rr) {
2268 WARN("%s - Ignoring reply with ID %i that arrived too late",
2269 h->ctx.module_name, h->buffer[1]);
2270 continue;
2271 }
2272
2273 treq = talloc_get_type_abort(rr->uctx, trunk_request_t);
2274 request = treq->request;
2275 fr_assert(request != NULL);
2276 u = talloc_get_type_abort(treq->rctx, bio_request_t);
2277 fr_assert(u == treq->preq);
2278
2279 /*
2280 * Decode the incoming packet
2281 */
2282 reason = decode(request->reply_ctx, &reply, &code, h, request, u, rr->vector, h->buffer, (size_t)slen);
2283 if (reason != FR_RADIUS_FAIL_NONE) continue;
2284
2285 /*
2286 * Only valid packets are processed
2287 * Otherwise an attacker could perform
2288 * a DoS attack against the proxying servers
2289 * by sending fake responses for upstream
2290 * servers.
2291 */
2292 h->last_reply = now = fr_time();
2293
2294 /*
2295 * Status-Server can have any reply code, we don't care
2296 * what it is. So long as it's signed properly, we
2297 * accept it. This flexibility is because we don't
2298 * expose Status-Server to the admins. It's only used by
2299 * this module for internal signalling.
2300 */
2301 if (u == h->status_u) {
2302 fr_pair_list_free(&reply); /* Probably want to pass this to status_check_reply? */
2303 status_check_reply(treq, now);
2304 trunk_request_signal_complete(treq);
2305 continue;
2306 }
2307
2308 /*
2309 * Handle any state changes, etc. needed by receiving a
2310 * Protocol-Error reply packet.
2311 *
2312 * Protocol-Error is also permitted as a reply to any
2313 * packet.
2314 */
2315 protocol_error_reply(u, h);
2316 }
2317}
2318
2319
2320/** Remove the request from any tracking structures
2321 *
2322 * Frees encoded packets if the request is being moved to a new connection
2323 */
2324static void request_cancel(UNUSED connection_t *conn, void *preq_to_reset,
2325 trunk_cancel_reason_t reason, UNUSED void *uctx)
2326{
2327 bio_request_t *u = preq_to_reset;
2328
2329 /*
2330 * Request has been requeued on the same
2331 * connection due to timeout or DUP signal. We
2332 * keep the same packet to avoid re-encoding it.
2333 */
2334 if (reason == TRUNK_CANCEL_REASON_REQUEUE) {
2335 /*
2336 * Delete the request_timeout
2337 *
2338 * Note: There might not be a request timeout
2339 * set in the case where the request was
2340 * queued for sendmmsg but never actually
2341 * sent.
2342 */
2343 FR_TIMER_DISARM(u->ev);
2344 }
2345
2346 /*
2347 * Other cancellations are dealt with by
2348 * request_conn_release as the request is removed
2349 * from the trunk.
2350 */
2351}
2352
2353/** Clear out anything associated with the handle from the request
2354 *
2355 */
2356static void request_conn_release(connection_t *conn, void *preq_to_reset, UNUSED void *uctx)
2357{
2358 bio_request_t *u = preq_to_reset;
2359 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
2360
2361 FR_TIMER_DISARM(u->ev);
2362 bio_request_reset(u);
2363
2364 if (h->ctx.inst->mode == RLM_RADIUS_MODE_REPLICATE) return;
2365
2366 u->num_replies = 0;
2367
2368 /*
2369 * If there are no outstanding tracking entries
2370 * allocated then the connection is "idle".
2371 */
2372 if (!h->tt || (h->tt->num_requests == 0)) h->last_idle = fr_time();
2373}
2374
2375/** Write out a canned failure
2376 *
2377 */
2378static void request_fail(request_t *request, NDEBUG_UNUSED void *preq, void *rctx,
2379 NDEBUG_UNUSED trunk_request_state_t state, UNUSED void *uctx)
2380{
2381 bio_request_t *u = talloc_get_type_abort(rctx, bio_request_t);
2382
2383 fr_assert(u == preq);
2384
2385 fr_assert(!u->rr && !u->packet && fr_pair_list_empty(&u->extra) && !u->ev); /* Dealt with by request_conn_release */
2386
2387 fr_assert(state != TRUNK_REQUEST_STATE_INIT);
2388
2389 if (u->status_check) return;
2390
2391 u->rcode = RLM_MODULE_FAIL;
2392 u->treq = NULL;
2393
2394 unlang_interpret_mark_runnable(request);
2395}
2396
2397/** Response has already been written to the rctx at this point
2398 *
2399 */
2400static void request_complete(request_t *request, NDEBUG_UNUSED void *preq, void *rctx, UNUSED void *uctx)
2401{
2402 bio_request_t *u = talloc_get_type_abort(rctx, bio_request_t);
2403
2404 fr_assert(u == preq);
2405
2406 fr_assert(!u->rr && !u->packet && fr_pair_list_empty(&u->extra) && !u->ev); /* Dealt with by request_conn_release */
2407
2408 if (u->status_check) return;
2409
2410 u->treq = NULL;
2411
2412 unlang_interpret_mark_runnable(request);
2413}
2414
2415/** Resume execution of the request, returning the rcode set during trunk execution
2416 *
2417 */
2418static unlang_action_t mod_resume(unlang_result_t *p_result, module_ctx_t const *mctx, UNUSED request_t *request)
2419{
2420 bio_request_t *u = talloc_get_type_abort(mctx->rctx, bio_request_t);
2421 rlm_rcode_t rcode = u->rcode;
2422
2423 talloc_free(u);
2424
2425 RETURN_UNLANG_RCODE(rcode);
2426}
2427
2428static void do_signal(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_signal_t action);
2429
2430static void mod_signal(module_ctx_t const *mctx, UNUSED request_t *request, fr_signal_t action)
2431{
2432 rlm_radius_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_radius_t);
2433
2434 bio_request_t *u = talloc_get_type_abort(mctx->rctx, bio_request_t);
2435
2436 do_signal(inst, u, request, action);
2437}
2438
2439static void do_signal(rlm_radius_t const *inst, bio_request_t *u, UNUSED request_t *request, fr_signal_t action)
2440{
2441 /*
2442 * We received a duplicate packet, but we're not doing
2443 * synchronous proxying. Ignore the dup, and rely on the
2444 * IO submodule to time it's own retransmissions.
2445 */
2446 if ((action == FR_SIGNAL_DUP) && (inst->mode != RLM_RADIUS_MODE_PROXY)) return;
2447
2448 /*
2449 * If we don't have a treq associated with the
2450 * rctx it's likely because the request was
2451 * scheduled, but hasn't yet been resumed, and
2452 * has received a signal, OR has been resumed
2453 * and immediately cancelled as the event loop
2454 * is exiting, in which case
2455 * unlang_request_is_scheduled will return false
2456 * (don't use it).
2457 */
2458 if (!u->treq) return;
2459
2460 switch (action) {
2461 /*
2462 * The request is being cancelled, tell the
2463 * trunk so it can clean up the treq.
2464 */
2465 case FR_SIGNAL_CANCEL:
2466 trunk_request_signal_cancel(u->treq);
2467 u->treq = NULL;
2468 return;
2469
2470 /*
2471 * Requeue the request on the same connection
2472 * causing a "retransmission" if the request
2473 * has already been sent out.
2474 */
2475 case FR_SIGNAL_DUP:
2476 mod_dup(request, u);
2477 return;
2478
2479 default:
2480 return;
2481 }
2482}
2483
2484/** Free a bio_request_t
2485 *
2486 * Allows us to set break points for debugging.
2487 */
2488static int _bio_request_free(bio_request_t *u)
2489{
2490 if (!u->treq) return 0;
2491
2492#ifndef NDEBUG
2493 {
2494 trunk_request_t *treq;
2495 treq = talloc_get_type_abort(u->treq, trunk_request_t);
2496 fr_assert(treq->preq == u);
2497 }
2498#endif
2499
2500 fr_assert_msg(!fr_timer_armed(u->ev), "bio_request_t freed with active timer");
2501
2502 FR_TIMER_DELETE_RETURN(&u->ev);
2503
2504 fr_assert(u->rr == NULL);
2505
2506 return 0;
2507}
2508
2509static int mod_enqueue(bio_request_t **p_u, fr_retry_config_t const **p_retry_config,
2510 rlm_radius_t const *inst, trunk_t *trunk, request_t *request)
2511{
2512 bio_request_t *u;
2513 trunk_request_t *treq;
2514 fr_retry_config_t const *retry_config;
2515
2516 fr_assert(request->packet->code > 0);
2517 fr_assert(request->packet->code < FR_RADIUS_CODE_MAX);
2518
2519 /*
2520 * Do any necessary RADIUS level fixups
2521 * - check Proxy-State
2522 * - do CHAP-Challenge fixups
2523 */
2524 if (radius_fixups(inst, request) < 0) return 0;
2525
2526 treq = trunk_request_alloc(trunk, request);
2527 if (!treq) {
2528 REDEBUG("Failed allocating handler for request");
2529 return -1;
2530 }
2531
2532 MEM(u = talloc_zero(request, bio_request_t));
2533 talloc_set_destructor(u, _bio_request_free);
2534
2535 /*
2536 * Can't use compound literal - const issues.
2537 */
2538 u->code = request->packet->code;
2539 u->priority = request->priority;
2540 u->recv_time = request->async->recv_time;
2541 fr_pair_list_init(&u->extra);
2542
2543 u->retry.count = 1;
2544
2545 u->rcode = RLM_MODULE_FAIL;
2546
2547 switch(trunk_request_enqueue(&treq, trunk, request, u, u)) {
2548 case TRUNK_ENQUEUE_OK:
2549 case TRUNK_ENQUEUE_IN_BACKLOG:
2550 break;
2551
2552 case TRUNK_ENQUEUE_NO_CAPACITY:
2553 REDEBUG("Unable to queue packet - connections at maximum capacity");
2554 fail:
2555 fr_assert(!u->rr && !u->packet); /* Should not have been fed to the muxer */
2556 trunk_request_free(&treq); /* Return to the free list */
2557 talloc_free(u);
2558 return -1;
2559
2560 case TRUNK_ENQUEUE_DST_UNAVAILABLE:
2561 REDEBUG("All destinations are down - cannot send packet");
2562 goto fail;
2563
2564 case TRUNK_ENQUEUE_FAIL:
2565 REDEBUG("Unable to queue packet");
2566 goto fail;
2567 }
2568
2569 u->treq = treq; /* Remember for signalling purposes */
2570 fr_assert(treq->rctx == u);
2571
2572 /*
2573 * Figure out if we're originating the packet or proxying it. And also figure out if we have to
2574 * retry.
2575 */
2576 switch (inst->mode) {
2577 case RLM_RADIUS_MODE_INVALID:
2578 case RLM_RADIUS_MODE_UNCONNECTED_REPLICATE: /* unconnected sockets are UDP, and bypass the trunk */
2579 REDEBUG("Internal sanity check failed - connection trunking cannot be used for replication");
2580 return -1;
2581
2582 /*
2583 * We originate this packet if it was taken from the detail module, which doesn't have a
2584 * real client. @todo - do a better check here.
2585 *
2586 * We originate this packet if the parent request is not compatible with this one
2587 * (i.e. it's from a different protocol).
2588 *
2589 * We originate the packet if the parent is from the same dictionary, but has a different
2590 * packet code. This lets us receive Accounting-Request, and originate
2591 * Disconnect-Request.
2592 */
2593 case RLM_RADIUS_MODE_XLAT_PROXY:
2594 case RLM_RADIUS_MODE_PROXY:
2595 if (!request->parent) {
2596 u->proxied = (request->client && request->client->cs != NULL);
2597
2598 } else if (!fr_dict_compatible(request->parent->proto_dict, request->proto_dict)) {
2599 u->proxied = false;
2600
2601 } else {
2602 u->proxied = (request->parent->packet->code == request->packet->code);
2603 }
2604
2605 /*
2606 * Proxied packets get a final timeout, as we retry only on DUP packets.
2607 */
2608 if (u->proxied) goto timeout_retry;
2609
2610 FALL_THROUGH;
2611
2612 /*
2613 * Client packets (i.e. packets we originate) get retries for UDP. And no retries for TCP.
2614 */
2615 case RLM_RADIUS_MODE_CLIENT:
2616 if (inst->fd_config.socket_type == SOCK_DGRAM) {
2617 retry_config = &inst->retry[u->code];
2618 break;
2619 }
2620 FALL_THROUGH;
2621
2622 /*
2623 * Replicated packets are never retried, but they have a timeout if the socket isn't
2624 * ready for writing.
2625 */
2626 case RLM_RADIUS_MODE_REPLICATE:
2627 timeout_retry:
2628 retry_config = &inst->timeout_retry;
2629 break;
2630 }
2631
2632 /*
2633 * The event loop will take care of demux && sending the
2634 * packet, along with any retransmissions.
2635 */
2636 *p_u = u;
2637 *p_retry_config = retry_config;
2638
2639 return 1;
2640}
2641
2642static void home_server_free(void *data)
2643{
2644 home_server_t *home = data;
2645
2646 talloc_free(home);
2647}
2648
2649static const trunk_io_funcs_t io_funcs = {
2650 .connection_alloc = thread_conn_alloc,
2651 .connection_notify = thread_conn_notify,
2652 .request_prioritise = request_prioritise,
2653 .request_mux = request_mux,
2654 .request_demux = request_demux,
2655 .request_conn_release = request_conn_release,
2656 .request_complete = request_complete,
2657 .request_fail = request_fail,
2658 .request_cancel = request_cancel,
2659};
2660
2661static const trunk_io_funcs_t io_replicate_funcs = {
2662 .connection_alloc = thread_conn_alloc,
2663 .connection_notify = thread_conn_notify,
2664 .request_prioritise = request_prioritise,
2665 .request_mux = request_replicate_mux,
2666 .request_demux = request_replicate_demux,
2667 .request_conn_release = request_conn_release,
2668 .request_complete = request_complete,
2669 .request_fail = request_fail,
2670 .request_cancel = request_cancel,
2671};
2672
2673/** Instantiate thread data for the submodule.
2674 *
2675 */
2676static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
2677{
2678 rlm_radius_t *inst = talloc_get_type_abort(mctx->mi->data, rlm_radius_t);
2679 bio_thread_t *thread = talloc_get_type_abort(mctx->thread, bio_thread_t);
2680
2681 thread->ctx.el = mctx->el;
2682 thread->ctx.inst = inst;
2683 thread->ctx.fd_config = inst->fd_config;
2684 thread->ctx.radius_ctx = inst->common_ctx;
2685
2686 switch (inst->mode) {
2687 case RLM_RADIUS_MODE_XLAT_PROXY:
2688 fr_rb_expire_inline_talloc_init(&thread->bio.expires, home_server_t, expire, home_server_cmp, home_server_free,
2689 inst->home_server_lifetime);
2690 FALL_THROUGH;
2691
2692 default:
2693 /*
2694 * Assign each thread a portion of the available source port range.
2695 */
2696 if (thread->ctx.fd_config.src_port_start) {
2697 uint16_t range = inst->fd_config.src_port_end - inst->fd_config.src_port_start + 1;
2698 thread->num_ports = range / main_config->max_workers;
2699 thread->ctx.fd_config.src_port_start = inst->fd_config.src_port_start + (thread->num_ports * fr_schedule_worker_id());
2700 thread->ctx.fd_config.src_port_end = inst->fd_config.src_port_start + (thread->num_ports * (fr_schedule_worker_id() +1)) - 1;
2701 if (inst->mode != RLM_RADIUS_MODE_XLAT_PROXY) {
2702 thread->connections = talloc_zero_array(thread, connection_t *, thread->num_ports);
2703 thread->ctx.limit_source_ports = LIMIT_PORTS_STATIC;
2704 }
2705 }
2706
2707 thread->ctx.trunk = trunk_alloc(thread, mctx->el, &io_funcs,
2708 &inst->trunk_conf, inst->name, thread, false, inst->trigger_args);
2709 if (!thread->ctx.trunk) return -1;
2710 return 0;
2711
2712 case RLM_RADIUS_MODE_REPLICATE:
2713 /*
2714 * We can replicate over TCP, but that uses trunks.
2715 */
2716 if (inst->fd_config.socket_type == SOCK_DGRAM) break;
2717
2718 thread->ctx.trunk = trunk_alloc(thread, mctx->el, &io_replicate_funcs,
2719 &inst->trunk_conf, inst->name, thread, false, inst->trigger_args);
2720 if (!thread->ctx.trunk) return -1;
2721 return 0;
2722
2723 case RLM_RADIUS_MODE_UNCONNECTED_REPLICATE:
2724 break;
2725 }
2726
2727 /*
2728 * If we have a port range, allocate the source port based
2729 * on the range start, plus the thread ID. This means
2730 * that we can avoid "hunt and peck" attempts to open up
2731 * the source port.
2732 */
2733 if (thread->ctx.fd_config.src_port_start) {
2734 thread->ctx.fd_config.src_port = thread->ctx.fd_config.src_port_start + fr_schedule_worker_id();
2735 }
2736
2737 /*
2738 * Allocate an unconnected socket for replication.
2739 */
2740 thread->bio.fd = fr_bio_fd_alloc(thread, &thread->ctx.fd_config, 0);
2741 if (!thread->bio.fd) {
2742 PERROR("%s - failed opening socket", inst->name);
2743 return -1;
2744 }
2745
2746 thread->bio.fd->uctx = thread;
2747 thread->ctx.fd_info = fr_bio_fd_info(thread->bio.fd);
2748 fr_assert(thread->ctx.fd_info != NULL);
2749
2750 (void) fr_bio_fd_write_only(thread->bio.fd);
2751
2752 DEBUG("%s - Opened unconnected replication socket %s", inst->name, thread->ctx.fd_info->name);
2753 return 0;
2754}
2755
2756static xlat_arg_parser_t const xlat_radius_send_args[] = {
2757 { .required = true, .single = true, .type = FR_TYPE_COMBO_IP_ADDR },
2758 { .required = true, .single = true, .type = FR_TYPE_UINT16 },
2759 { .required = true, .single = true, .type = FR_TYPE_STRING },
2760 XLAT_ARG_PARSER_TERMINATOR
2761};
2762
2763/*
2764 * %replicate.sendto.ipaddr(ipaddr, port, secret)
2765 */
2766static xlat_action_t xlat_radius_replicate(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out,
2767 xlat_ctx_t const *xctx,
2768 request_t *request, fr_value_box_list_t *args)
2769{
2770 bio_thread_t *thread = talloc_get_type_abort(xctx->mctx->thread, bio_thread_t);
2771 fr_value_box_t *ipaddr, *port, *secret;
2772 ssize_t packet_len;
2773 uint8_t buffer[4096];
2774 fr_radius_ctx_t radius_ctx;
2775 fr_radius_encode_ctx_t encode_ctx;
2776 fr_bio_fd_packet_ctx_t addr;
2777
2778 XLAT_ARGS(args, &ipaddr, &port, &secret);
2779
2780 /*
2781 * Can't change IP address families.
2782 */
2783 if (ipaddr->vb_ip.af != thread->ctx.fd_info->socket.af) {
2784 RPERROR("Invalid destination IP address family in %pV", ipaddr);
2785 return XLAT_ACTION_FAIL;
2786 }
2787
2788 /*
2789 * Warn if we're not replicating accounting data. It likely won't wokr/
2790 */
2791 if (request->packet->code != FR_RADIUS_CODE_ACCOUNTING_REQUEST) {
2792 RWDEBUG("Replication of packets other then Accounting-Request will likely not do what you want.");
2793 }
2794
2795 /*
2796 * Set up various context things.
2797 */
2798 radius_ctx = (fr_radius_ctx_t) {
2799 .secret = secret->vb_strvalue,
2800 .secret_length = secret->vb_length,
2801 .proxy_state = 0,
2802 };
2803
2804 encode_ctx = (fr_radius_encode_ctx_t) {
2805 .common = &radius_ctx,
2806 .rand_ctx = (fr_fast_rand_t) {
2807 .a = fr_rand(),
2808 .b = fr_rand(),
2809 },
2810 .code = request->packet->code,
2811 .id = thread->bio.id++ & 0xff,
2812 .add_proxy_state = false,
2813 };
2814
2815 /*
2816 * Encode the entire packet.
2817 */
2818 packet_len = fr_radius_encode(&FR_DBUFF_TMP(buffer, sizeof(buffer)),
2819 &request->request_pairs, &encode_ctx);
2820 if (packet_len < 0) {
2821 RPERROR("Failed encoding replicated packet");
2822 return XLAT_ACTION_FAIL;
2823 }
2824
2825 /*
2826 * Sign it.
2827 */
2828 if (fr_radius_sign(buffer, NULL, (uint8_t const *) radius_ctx.secret, radius_ctx.secret_length) < 0) {
2829 RPERROR("Failed signing replicated packet");
2830 return XLAT_ACTION_FAIL;
2831 }
2832
2833 /*
2834 * Prepare destination address.
2835 */
2836 addr = (fr_bio_fd_packet_ctx_t) {
2837 .socket = thread->ctx.fd_info->socket,
2838 };
2839 addr.socket.inet.dst_ipaddr = ipaddr->vb_ip;
2840 addr.socket.inet.dst_port = port->vb_uint16;
2841
2842 RDEBUG("Replicating packet to %pV:%u", ipaddr, port->vb_uint16);
2843
2844 /*
2845 * We either send it, or fail.
2846 */
2847 packet_len = fr_bio_write(thread->bio.fd, &addr, buffer, packet_len);
2848 if (packet_len < 0) {
2849 RPERROR("Failed replicating packet to %pV:%u", ipaddr, port->vb_uint16);
2850 return XLAT_ACTION_FAIL;
2851 }
2852
2853 /*
2854 * No return value.
2855 */
2856 return XLAT_ACTION_DONE;
2857}
2858
2859// **********************************************************************
2860
2861/** Dynamic home server code
2862 *
2863 */
2864
2865static int8_t home_server_cmp(void const *one, void const *two)
2866{
2867 home_server_t const *a = one;
2868 home_server_t const *b = two;
2869 int8_t rcode;
2870
2871 rcode = fr_ipaddr_cmp(&a->ctx.fd_config.dst_ipaddr, &b->ctx.fd_config.dst_ipaddr);
2872 if (rcode != 0) return rcode;
2873
2874 return CMP(a->ctx.fd_config.dst_port, b->ctx.fd_config.dst_port);
2875}
2876
2877static xlat_action_t xlat_sendto_resume(TALLOC_CTX *ctx, fr_dcursor_t *out,
2878 xlat_ctx_t const *xctx,
2879 request_t *request, UNUSED fr_value_box_list_t *in)
2880{
2881 bio_request_t *u = talloc_get_type_abort(xctx->rctx, bio_request_t);
2882 fr_value_box_t *dst;
2883
2884 if (u->rcode == RLM_MODULE_FAIL) return XLAT_ACTION_FAIL;
2885
2886 MEM(dst = fr_value_box_alloc(ctx, FR_TYPE_UINT32, attr_packet_type));
2887 dst->vb_uint32 = request->reply->code;
2888
2889 fr_dcursor_append(out, dst);
2890
2891 return XLAT_ACTION_DONE;
2892}
2893
2894static void xlat_sendto_signal(xlat_ctx_t const *xctx, request_t *request, fr_signal_t action)
2895{
2896 rlm_radius_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_radius_t);
2897 bio_request_t *u = talloc_get_type_abort(xctx->rctx, bio_request_t);
2898
2899 do_signal(inst, u, request, action);
2900}
2901
2902/*
2903 * @todo - change this to mod_retry
2904 */
2905static void xlat_sendto_retry(xlat_ctx_t const *xctx, request_t *request, fr_retry_t const *retry)
2906{
2907 rlm_radius_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_radius_t);
2908 bio_request_t *u = talloc_get_type_abort(xctx->rctx, bio_request_t);
2909
2910 do_retry(inst, u, request, retry);
2911}
2912
2913/*
2914 * %proxy.sendto.ipaddr(ipaddr, port, secret)
2915 */
2916static xlat_action_t xlat_radius_client(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out,
2917 xlat_ctx_t const *xctx,
2918 request_t *request, fr_value_box_list_t *args)
2919{
2920 rlm_radius_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_radius_t);
2921 bio_thread_t *thread = talloc_get_type_abort(xctx->mctx->thread, bio_thread_t);
2922 fr_value_box_t *ipaddr, *port, *secret;
2923 home_server_t *home;
2924 bio_request_t *u = NULL;
2925 fr_retry_config_t const *retry_config = NULL;
2926 int rcode;
2927
2928 XLAT_ARGS(args, &ipaddr, &port, &secret);
2929
2930 /*
2931 * Can't change IP address families.
2932 */
2933 if (ipaddr->vb_ip.af != thread->ctx.fd_config.src_ipaddr.af) {
2934 RDEBUG("Invalid destination IP address family in %pV", ipaddr);
2935 return XLAT_ACTION_DONE;
2936 }
2937
2938 home = fr_rb_find(&thread->bio.expires.tree, &(home_server_t) {
2939 .ctx = {
2940 .fd_config = (fr_bio_fd_config_t) {
2941 .dst_ipaddr = ipaddr->vb_ip,
2942 .dst_port = port->vb_uint16,
2943 },
2944 },
2945 });
2946 if (!home) {
2947 /*
2948 * Track which connections are made to this home server from which open ports.
2949 */
2950 MEM(home = (home_server_t *) talloc_zero_array(thread, uint8_t, sizeof(home_server_t) + sizeof(connection_t *) * thread->num_ports));
2951 talloc_set_type(home, home_server_t);
2952
2953 *home = (home_server_t) {
2954 .ctx = (bio_handle_ctx_t) {
2955 .el = unlang_interpret_event_list(request),
2956 .module_name = inst->name,
2957 .inst = inst,
2958 .limit_source_ports = (thread->num_ports > 0) ? LIMIT_PORTS_DYNAMIC : LIMIT_PORTS_NONE,
2959 },
2960 .num_ports = thread->num_ports,
2961 };
2962
2963 /*
2964 * Copy the home server configuration from the thread configuration. Then update it with
2965 * the needs of the home server.
2966 */
2967 home->ctx.fd_config = thread->ctx.fd_config;
2968 home->ctx.fd_config.type = FR_BIO_FD_CONNECTED;
2969 home->ctx.fd_config.dst_ipaddr = ipaddr->vb_ip;
2970 home->ctx.fd_config.dst_port = port->vb_uint32;
2971
2972 home->ctx.radius_ctx = (fr_radius_ctx_t) {
2973 .secret = talloc_strdup(home, secret->vb_strvalue),
2974 .secret_length = secret->vb_length,
2975 .proxy_state = inst->common_ctx.proxy_state,
2976 };
2977
2978 /*
2979 * Allocate the trunk and start it up.
2980 */
2981 home->ctx.trunk = trunk_alloc(home, unlang_interpret_event_list(request), &io_funcs,
2982 &inst->trunk_conf, inst->name, home, false, inst->trigger_args);
2983 if (!home->ctx.trunk) {
2984 fail:
2985 talloc_free(home);
2986 return XLAT_ACTION_FAIL;
2987 }
2988
2989 if (!fr_rb_expire_insert(&thread->bio.expires, home, fr_time())) goto fail;
2990 } else {
2991 fr_rb_expire_t *expire = &thread->bio.expires;
2992 fr_time_t now = fr_time();
2993 home_server_t *old;
2994
2995 /*
2996 * We can't change secrets on the fly. The home
2997 * server has to expire first, and then the
2998 * secret can be changed.
2999 */
3000 if ((home->ctx.radius_ctx.secret_length != secret->vb_length) ||
3001 (strcmp(home->ctx.radius_ctx.secret, secret->vb_strvalue) != 0)) {
3002 RWDEBUG("The new secret is not the same as the old secret: Ignoring the new one");
3003 }
3004
3005 fr_rb_expire_update(expire, home, now);
3006
3007 while ((old = fr_dlist_head(&expire->head)) != NULL) {
3008 (void) talloc_get_type_abort(old, home_server_t);
3009
3010 fr_assert(old->ctx.trunk);
3011
3012 /*
3013 * Don't delete the home server we're about to use.
3014 */
3015 if (old == home) break;
3016
3017 /*
3018 * It still has a request allocated, do nothing.
3019 */
3020 if (old->ctx.trunk->req_alloc) break;
3021
3022 /*
3023 * Not yet time to expire.
3024 */
3025 if (fr_time_gt(old->expire.when, now)) break;
3026
3027 fr_dlist_remove(&expire->head, old);
3028 fr_rb_delete(&expire->tree, old);
3029 }
3030 }
3031
3032 /*
3033 * Enqueue the packet on the per-home-server trunk.
3034 */
3035 rcode = mod_enqueue(&u, &retry_config, inst, home->ctx.trunk, request);
3036 if (rcode == 0) return XLAT_ACTION_DONE;
3037
3038 if (rcode < 0) {
3039 REDEBUG("Failed enqueuing packet");
3040 return XLAT_ACTION_FAIL;
3041 }
3042 fr_assert(u != NULL);
3043 fr_assert(retry_config != NULL);
3044
3045 /*
3046 * Start the retry.
3047 *
3048 * @todo - change unlang_xlat_timeout_add() to unlang_xlat_retry_add().
3049 */
3050 fr_retry_init(&u->retry, fr_time(), retry_config);
3051
3052 return unlang_xlat_yield_to_retry(request, xlat_sendto_resume, xlat_sendto_retry,
3053 xlat_sendto_signal, ~(FR_SIGNAL_CANCEL | FR_SIGNAL_DUP),
3054 u, retry_config);
3055}
unlang_action_t
unlang_action_t
Returned by unlang_op_t calls, determine the next action of the interpreter.
Definition action.h:35
buffer
static int const char char buffer[256]
Definition acutest.h:578
file
int const char * file
Definition acutest.h:704
args
va_list args
Definition acutest.h:772
line
int const char int line
Definition acutest.h:704
fr_bio_write
static ssize_t fr_bio_write(fr_bio_t *bio, void *packet_ctx, void const *buffer, size_t size)
Write raw data to a bio.
Definition base.h:184
fr_bio_read
static ssize_t fr_bio_read(fr_bio_t *bio, void *packet_ctx, void *buffer, size_t size)
Read raw data from a bio.
Definition base.h:161
fr_bio_s::uctx
void * uctx
user ctx, caller can manually set it.
Definition base.h:114
fr_bio_error
#define fr_bio_error(_x)
Definition base.h:200
fr_bio_s
Definition base.h:113
NDEBUG_UNUSED
#define NDEBUG_UNUSED
Definition build.h:328
FALL_THROUGH
#define FALL_THROUGH
clang 10 doesn't recognised the FALL-THROUGH comment anymore
Definition build.h:324
CC_NO_UBSAN
#define CC_NO_UBSAN(_sanitize)
Definition build.h:430
CMP_PREFER_LARGER
#define CMP_PREFER_LARGER(_a, _b)
Evaluates to -1 for a > b, and +1 for a < b.
Definition build.h:108
CMP
#define CMP(_a, _b)
Same as CMP_PREFER_SMALLER use when you don't really care about ordering, you just want an ordering.
Definition build.h:112
unlikely
#define unlikely(_x)
Definition build.h:383
UNUSED
#define UNUSED
Definition build.h:317
connection_state_t
connection_state_t
Definition connection.h:47
CONNECTION_STATE_FAILED
@ CONNECTION_STATE_FAILED
Connection has failed.
Definition connection.h:56
CONNECTION_STATE_CONNECTED
@ CONNECTION_STATE_CONNECTED
File descriptor is open (ready for writing).
Definition connection.h:54
CONNECTION_STATE_INIT
@ CONNECTION_STATE_INIT
Init state, sets up connection.
Definition connection.h:51
CONNECTION_STATE_CONNECTING
@ CONNECTION_STATE_CONNECTING
Waiting for connection to establish.
Definition connection.h:52
CONNECTION_FAILED
@ CONNECTION_FAILED
Connection is being reconnected because it failed.
Definition connection.h:85
connection_conf_t
Definition connection.h:92
connection_funcs_t
Holds a complete set of functions for a connection.
Definition connection.h:195
FR_DBUFF_TMP
#define FR_DBUFF_TMP(_start, _len_or_end)
Creates a compound literal to pass into functions which accept a dbuff.
Definition dbuff.h:524
fr_dcursor_append
static int fr_dcursor_append(fr_dcursor_t *cursor, void *v)
Insert a single item at the end of the list.
Definition dcursor.h:408
fr_dcursor_s
Definition dcursor.h:93
fr_assert_msg
#define fr_assert_msg(_x, _msg,...)
Calls panic_action ifndef NDEBUG, else logs error and causes the server to exit immediately with code...
Definition debug.h:202
fr_assert_fail
#define fr_assert_fail(_msg,...)
Calls panic_action ifndef NDEBUG, else logs error.
Definition debug.h:208
MEM
#define MEM(x)
Definition debug.h:36
FR_RADIUS_CODE_ACCESS_CHALLENGE
@ FR_RADIUS_CODE_ACCESS_CHALLENGE
RFC2865 - Access-Challenge.
Definition defs.h:43
FR_RADIUS_CODE_ACCESS_REQUEST
@ FR_RADIUS_CODE_ACCESS_REQUEST
RFC2865 - Access-Request.
Definition defs.h:33
FR_RADIUS_CODE_MAX
@ FR_RADIUS_CODE_MAX
Maximum possible protocol code.
Definition defs.h:53
FR_RADIUS_CODE_DISCONNECT_ACK
@ FR_RADIUS_CODE_DISCONNECT_ACK
RFC3575/RFC5176 - Disconnect-Ack (positive)
Definition defs.h:47
FR_RADIUS_CODE_ACCESS_ACCEPT
@ FR_RADIUS_CODE_ACCESS_ACCEPT
RFC2865 - Access-Accept.
Definition defs.h:34
FR_RADIUS_CODE_ACCOUNTING_RESPONSE
@ FR_RADIUS_CODE_ACCOUNTING_RESPONSE
RFC2866 - Accounting-Response.
Definition defs.h:37
FR_RADIUS_CODE_COA_NAK
@ FR_RADIUS_CODE_COA_NAK
RFC3575/RFC5176 - CoA-Nak (not willing to perform)
Definition defs.h:51
FR_RADIUS_CODE_COA_ACK
@ FR_RADIUS_CODE_COA_ACK
RFC3575/RFC5176 - CoA-Ack (positive)
Definition defs.h:50
FR_RADIUS_CODE_DISCONNECT_NAK
@ FR_RADIUS_CODE_DISCONNECT_NAK
RFC3575/RFC5176 - Disconnect-Nak (not willing to perform)
Definition defs.h:48
FR_RADIUS_CODE_PROTOCOL_ERROR
@ FR_RADIUS_CODE_PROTOCOL_ERROR
RFC7930 - Protocol-Error (generic NAK)
Definition defs.h:52
FR_RADIUS_CODE_ACCOUNTING_REQUEST
@ FR_RADIUS_CODE_ACCOUNTING_REQUEST
RFC2866 - Accounting-Request.
Definition defs.h:36
FR_RADIUS_CODE_ACCESS_REJECT
@ FR_RADIUS_CODE_ACCESS_REJECT
RFC2865 - Access-Reject.
Definition defs.h:35
attr_packet_type
static fr_dict_attr_t const * attr_packet_type
Definition dhcpclient.c:89
ERROR
#define ERROR(fmt,...)
Definition dhcpclient.c:41
main
int main(int argc, char **argv)
Definition dhcpclient.c:531
DEBUG
#define DEBUG(fmt,...)
Definition dhcpclient.c:39
fr_dict_compatible
bool fr_dict_compatible(fr_dict_t const *dict1, fr_dict_t const *dict2)
See if two dictionaries have the same end parent.
Definition dict_util.c:2885
in
static fr_slen_t in
Definition dict.h:884
fr_dlist_head
static void * fr_dlist_head(fr_dlist_head_t const *list_head)
Return the HEAD item of a list or NULL if the list is empty.
Definition dlist.h:468
fr_dlist_remove
static void * fr_dlist_remove(fr_dlist_head_t *list_head, void *ptr)
Remove an item from the list.
Definition dlist.h:620
fr_event_fd_insert
#define fr_event_fd_insert(...)
Definition event.h:248
fr_event_fd_cb_t
void(* fr_event_fd_cb_t)(fr_event_list_t *el, int fd, int flags, void *uctx)
Called when an IO event occurs on a file descriptor.
Definition event.h:151
fr_bio_fd_connect_full
int fr_bio_fd_connect_full(fr_bio_t *bio, fr_event_list_t *el, fr_bio_callback_t connected_cb, fr_bio_callback_t error_cb, fr_time_delta_t *timeout, fr_bio_callback_t timeout_cb)
Finalize a connect()
Definition fd.c:1198
fr_bio_fd_alloc
fr_bio_t * fr_bio_fd_alloc(TALLOC_CTX *ctx, fr_bio_fd_config_t const *cfg, size_t offset)
Allocate a FD bio.
Definition fd.c:971
fr_bio_fd_info
fr_bio_fd_info_t const * fr_bio_fd_info(fr_bio_t *bio)
Returns a pointer to the bio-specific information.
Definition fd.c:1295
fr_bio_fd_write_only
int fr_bio_fd_write_only(fr_bio_t *bio)
Mark up a bio as write-only.
Definition fd.c:1348
fr_bio_fd_info_t::socket
fr_socket_t socket
as connected socket
Definition fd.h:132
fr_bio_fd_info_t::name
char const * name
printable name of this BIO
Definition fd.h:137
fr_bio_fd_config_t::src_port
uint16_t src_port
our port
Definition fd.h:91
fr_bio_fd_info_t::eof
bool eof
are we at EOF?
Definition fd.h:141
FR_BIO_FD_CONNECTED
@ FR_BIO_FD_CONNECTED
connected client sockets (UDP or TCP)
Definition fd.h:68
fr_bio_fd_info_t::state
fr_bio_fd_state_t state
connecting, open, closed, etc.
Definition fd.h:135
fr_bio_fd_config_t::src_port_start
uint16_t src_port_start
limit source port ranges for client BIOs
Definition fd.h:94
FR_BIO_FD_STATE_CONNECTING
@ FR_BIO_FD_STATE_CONNECTING
Definition fd.h:60
FR_BIO_FD_STATE_OPEN
@ FR_BIO_FD_STATE_OPEN
error states must be before this
Definition fd.h:59
fr_bio_fd_info_t::connect_errno
int connect_errno
from connect() or other APIs
Definition fd.h:143
fr_bio_fd_config_t::dst_ipaddr
fr_ipaddr_t dst_ipaddr
their IP address
Definition fd.h:89
fr_bio_fd_config_t::src_port_end
uint16_t src_port_end
limit source port ranges for client BIOs
Definition fd.h:95
fr_bio_fd_config_t::socket_type
int socket_type
SOCK_STREAM or SOCK_DGRAM.
Definition fd.h:83
fr_bio_fd_config_t::dst_port
uint16_t dst_port
their port
Definition fd.h:92
fr_bio_fd_packet_ctx_t::socket
fr_socket_t socket
socket information, including FD.
Definition fd.h:52
fr_bio_fd_info_t::write_blocked
bool write_blocked
did we block on write?
Definition fd.h:140
fr_bio_fd_config_t::src_ipaddr
fr_ipaddr_t src_ipaddr
our IP address
Definition fd.h:88
fr_bio_fd_config_t
Configuration for sockets.
Definition fd.h:80
fr_bio_fd_info_t
Run-time status of the socket.
Definition fd.h:131
fr_bio_fd_packet_ctx_t
Per-packet context.
Definition fd.h:51
talloc_free
talloc_free(hp)
fr_ipaddr_cmp
int8_t fr_ipaddr_cmp(fr_ipaddr_t const *a, fr_ipaddr_t const *b)
Compare two ip addresses.
Definition inet.c:1354
fr_ipaddr_t::af
int af
Address family.
Definition inet.h:64
unlang_interpret_mark_runnable
void unlang_interpret_mark_runnable(request_t *request)
Mark a request as resumable.
Definition interpret.c:1639
unlang_interpret_event_list
fr_event_list_t * unlang_interpret_event_list(request_t *request)
Get the event list for the current interpreter.
Definition interpret.c:2052
unlang_result_t
Definition interpret.h:133
fr_async_s
Minimal data structure to use the new code.
Definition listen.h:63
fr_bio_mem_alloc
fr_bio_t * fr_bio_mem_alloc(TALLOC_CTX *ctx, size_t read_size, size_t write_size, fr_bio_t *next)
Allocate a memory buffer bio.
Definition mem.c:729
fr_bio_mem_set_verify
int fr_bio_mem_set_verify(fr_bio_t *bio, fr_bio_verify_t verify, void *verify_ctx, bool datagram)
Set the verification function for memory bios.
Definition mem.c:906
attr_eap_message
HIDDEN fr_dict_attr_t const * attr_eap_message
Definition base.c:96
log_request_proto_pair_list
void log_request_proto_pair_list(fr_log_lvl_t lvl, request_t *request, fr_pair_t const *parent, fr_pair_list_t const *vps, char const *prefix)
Print a list of protocol fr_pair_ts.
Definition log.c:844
log_request_pair_list
void log_request_pair_list(fr_log_lvl_t lvl, request_t *request, fr_pair_t const *parent, fr_pair_list_t const *vps, char const *prefix)
Print a fr_pair_list_t.
Definition log.c:820
PERROR
#define PERROR(_fmt,...)
Definition log.h:228
DEBUG3
#define DEBUG3(_fmt,...)
Definition log.h:266
RWDEBUG
#define RWDEBUG(fmt,...)
Definition log.h:373
RWARN
#define RWARN(fmt,...)
Definition log.h:309
DEBUG4
#define DEBUG4(_fmt,...)
Definition log.h:267
RPERROR
#define RPERROR(fmt,...)
Definition log.h:314
RINFO
#define RINFO(fmt,...)
Definition log.h:308
RPEDEBUG
#define RPEDEBUG(fmt,...)
Definition log.h:388
HEXDUMP3
#define HEXDUMP3(_data, _len, _fmt,...)
Definition log.h:735
RHEXDUMP3
#define RHEXDUMP3(_data, _len, _fmt,...)
Definition log.h:717
map_to_vp
int map_to_vp(TALLOC_CTX *ctx, fr_pair_list_t *out, request_t *request, map_t const *map, UNUSED void *uctx)
Convert a map to a fr_pair_t.
Definition map.c:1601
map_to_request
int map_to_request(request_t *request, map_t const *map, radius_map_getvalue_t func, void *ctx)
Convert map_t to fr_pair_t (s) and add them to a request_t.
Definition map.c:1881
fr_time
#define fr_time()
Definition event.c:60
fr_event_list_s
Stores all information relating to an event list.
Definition event.c:377
default_log
fr_log_t default_log
Definition log.c:288
fr_log
void fr_log(fr_log_t const *log, fr_log_type_t type, char const *file, int line, char const *fmt,...)
Send a server log message to its destination.
Definition log.c:577
L_DBG_LVL_3
@ L_DBG_LVL_3
3rd highest priority debug messages (-xxx | -Xx).
Definition log.h:72
L_DBG_LVL_2
@ L_DBG_LVL_2
2nd highest priority debug messages (-xx | -X).
Definition log.h:71
fr_log_type_t
fr_log_type_t
Definition log.h:54
L_ERR
@ L_ERR
Error message.
Definition log.h:56
fr_packet_alloc
fr_packet_t * fr_packet_alloc(TALLOC_CTX *ctx, bool new_vector)
Allocate a new fr_packet_t.
Definition packet.c:38
main_config
main_config_t const * main_config
Main server configuration.
Definition main_config.c:58
main_config_s::max_workers
uint32_t max_workers
for the scheduler
Definition main_config.h:148
fr_bio_verify_action_t
fr_bio_verify_action_t
Status returned by the verification callback.
Definition mem.h:32
FR_BIO_VERIFY_ERROR_CLOSE
@ FR_BIO_VERIFY_ERROR_CLOSE
fatal error, the bio should be closed.
Definition mem.h:36
FR_BIO_VERIFY_DISCARD
@ FR_BIO_VERIFY_DISCARD
the packet should be discarded
Definition mem.h:34
FR_BIO_VERIFY_OK
@ FR_BIO_VERIFY_OK
packet is OK
Definition mem.h:33
FR_BIO_VERIFY_WANT_MORE
@ FR_BIO_VERIFY_WANT_MORE
not enough data for one packet
Definition mem.h:35
fr_radius_ok
bool fr_radius_ok(uint8_t const *packet, size_t *packet_len_p, uint32_t max_attributes, bool require_message_authenticator, decode_fail_t *reason)
Definition merged_model.c:253
uint16_t
unsigned short uint16_t
Definition merged_model.c:31
FR_TYPE_STRING
@ FR_TYPE_STRING
String of printable characters.
Definition merged_model.c:83
FR_TYPE_UINT16
@ FR_TYPE_UINT16
16 Bit unsigned integer.
Definition merged_model.c:98
FR_TYPE_UINT32
@ FR_TYPE_UINT32
32 Bit unsigned integer.
Definition merged_model.c:99
FR_TYPE_COMBO_IP_ADDR
@ FR_TYPE_COMBO_IP_ADDR
IPv4 or IPv6 address depending on length.
Definition merged_model.c:91
uint32_t
unsigned int uint32_t
Definition merged_model.c:33
ssize_t
long int ssize_t
Definition merged_model.c:24
uint8_t
unsigned char uint8_t
Definition merged_model.c:30
fr_value_box_t
Definition merged_model.c:136
request_t
Definition merged_model.c:210
module_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition module_ctx.h:42
module_ctx_t::thread
void * thread
Thread specific instance data.
Definition module_ctx.h:43
module_ctx_t::rctx
void * rctx
Resume ctx that a module previously set.
Definition module_ctx.h:45
module_thread_inst_ctx_t::el
fr_event_list_t * el
Event list to register any IO handlers and timers against.
Definition module_ctx.h:68
module_thread_inst_ctx_t::thread
void * thread
Thread instance data.
Definition module_ctx.h:67
module_thread_inst_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition module_ctx.h:64
module_ctx_t
Temporary structure to hold arguments for module calls.
Definition module_ctx.h:41
module_thread_inst_ctx_t
Temporary structure to hold arguments for thread_instantiation calls.
Definition module_ctx.h:63
mod_enqueue
static int mod_enqueue(bio_request_t **p_u, fr_retry_config_t const **p_retry_config, rlm_radius_t const *inst, trunk_t *trunk, request_t *request)
Definition bio.c:2509
bio_handle_ctx_t::fd_config
fr_bio_fd_config_t fd_config
for threads or sockets
Definition bio.c:51
home_server_t::num_ports
int num_ports
Definition bio.c:146
request_prioritise
static int8_t request_prioritise(void const *one, void const *two)
Definition bio.c:1154
do_retry
static void do_retry(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_retry_t const *retry)
Definition bio.c:1530
bio_request_s::ev
fr_timer_t * ev
timer for retransmissions
Definition bio.c:137
check_for_zombie
static bool check_for_zombie(fr_event_list_t *el, trunk_connection_t *tconn, fr_time_t now, fr_time_t last_sent)
See if the connection is zombied.
Definition bio.c:1427
request_replicate_mux
static void request_replicate_mux(UNUSED fr_event_list_t *el, trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
Definition bio.c:2187
conn_init_error
static void conn_init_error(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, void *uctx)
Connection errored.
Definition bio.c:338
request_demux
static void request_demux(UNUSED fr_event_list_t *el, trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
Definition bio.c:2019
conn_discard
static void conn_discard(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
Read and discard data.
Definition bio.c:1038
bio_request_s::id
uint8_t id
Last ID assigned to this packet.
Definition bio.c:131
request_replicate_demux
static void request_replicate_demux(UNUSED fr_event_list_t *el, trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
Definition bio.c:2204
bio_handle_t::max_packet_size
uint32_t max_packet_size
Our max packet size. may be different from the parent.
Definition bio.c:91
do_signal
static void do_signal(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_signal_t action)
bio_connected
static void bio_connected(fr_bio_t *bio)
Definition bio.c:631
bio_request_s::num_replies
uint32_t num_replies
number of reply packets, sent is in retry.count
Definition bio.c:123
io_funcs
static const trunk_io_funcs_t io_funcs
Definition bio.c:2649
conn_close
static void conn_close(UNUSED fr_event_list_t *el, void *handle, void *uctx)
Shutdown/close a file descriptor.
Definition bio.c:912
bio_limit_ports_t
bio_limit_ports_t
Definition bio.c:40
LIMIT_PORTS_DYNAMIC
@ LIMIT_PORTS_DYNAMIC
Limited source ports for dynamic home servers.
Definition bio.c:43
LIMIT_PORTS_NONE
@ LIMIT_PORTS_NONE
Source port not restricted.
Definition bio.c:41
LIMIT_PORTS_STATIC
@ LIMIT_PORTS_STATIC
Limited source ports for static home servers.
Definition bio.c:42
bio_request_s::priority
uint32_t priority
copied from request->async->priority
Definition bio.c:120
radius_code_to_rcode
static rlm_rcode_t radius_code_to_rcode[FR_RADIUS_CODE_MAX]
Turn a reply code into a module rcode;.
Definition bio.c:154
conn_error
static void conn_error(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, void *uctx)
Connection errored.
Definition bio.c:1073
bio_handle_ctx_t::module_name
char const * module_name
the module that opened the connection
Definition bio.c:47
bio_handle_ctx_t::fd_info
fr_bio_fd_info_t const * fd_info
status of the FD.
Definition bio.c:52
home_server_t::connections
connection_t * connections[]
for tracking outbound connections
Definition bio.c:147
mod_signal
static void mod_signal(module_ctx_t const *mctx, UNUSED request_t *request, fr_signal_t action)
Definition bio.c:2430
bio_handle_t::last_id
uint8_t last_id
Used when replicating to ensure IDs are distributed evenly.
Definition bio.c:88
mod_retry
static void mod_retry(module_ctx_t const *mctx, request_t *request, fr_retry_t const *retry)
Handle module retries.
Definition bio.c:1522
decode
static fr_radius_decode_fail_t decode(TALLOC_CTX *ctx, fr_pair_list_t *reply, uint8_t *response_code, bio_handle_t *h, request_t *request, bio_request_t *u, uint8_t const request_authenticator[static RADIUS_AUTH_VECTOR_LENGTH], uint8_t *data, size_t data_len)
Decode response packet data, extracting relevant information and validating the packet.
Definition bio.c:1193
thread_conn_notify
static void thread_conn_notify(trunk_connection_t *tconn, connection_t *conn, fr_event_list_t *el, trunk_connection_event_t notify_on, UNUSED void *uctx)
Definition bio.c:1085
encode
static int encode(bio_handle_t *h, request_t *request, bio_request_t *u, uint8_t id)
Definition bio.c:1260
bio_handle_t::last_reply
fr_time_t last_reply
When we last received a reply.
Definition bio.c:99
request_conn_release
static void request_conn_release(connection_t *conn, void *preq_to_reset, UNUSED void *uctx)
Clear out anything associated with the handle from the request.
Definition bio.c:2356
bio_handle_t::fd
int fd
File descriptor.
Definition bio.c:78
bio_handle_t::status_u
bio_request_t * status_u
for sending status check packets
Definition bio.c:107
bio_thread_t::ctx
bio_handle_ctx_t ctx
common struct for home servers and BIO handles
Definition bio.c:58
rlm_radius_verify
static fr_bio_verify_action_t rlm_radius_verify(UNUSED fr_bio_t *bio, void *verify_ctx, UNUSED void *packet_ctx, const void *data, size_t *size)
Definition bio.c:650
bio_thread_t::bio
struct bio_thread_t::@187 bio
mod_write
static void mod_write(request_t *request, trunk_request_t *treq, bio_handle_t *h)
Definition bio.c:1632
REQUIRE_MA
#define REQUIRE_MA(_h)
bio_request_s::extra
fr_pair_list_t extra
VPs for debugging, like Proxy-State.
Definition bio.c:128
bio_request_s::proxied
bool proxied
is this request being proxied
Definition bio.c:126
bio_handle_t::buflen
size_t buflen
Receive buffer length.
Definition bio.c:94
conn_init_readable
static void conn_init_readable(fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
Read the connection during the init and negotiation stage.
Definition bio.c:421
bio_handle_t::last_idle
fr_time_t last_idle
last time we had nothing to do
Definition bio.c:102
bio_tracking_entry_log
static void bio_tracking_entry_log(fr_log_t const *log, fr_log_type_t log_type, char const *file, int line, radius_track_entry_t *te)
Log additional information about a tracking entry.
Definition bio.c:197
xlat_radius_replicate
static xlat_action_t xlat_radius_replicate(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *args)
Definition bio.c:2766
bio_request_s::rr
radius_track_entry_t * rr
ID tracking, resend count, etc.
Definition bio.c:136
bio_request_s::packet_len
size_t packet_len
Length of the packet.
Definition bio.c:133
_bio_handle_free
static int _bio_handle_free(bio_handle_t *h)
Free a connection handle, closing associated resources.
Definition bio.c:614
bio_request_s::partial
size_t partial
partially sent data
Definition bio.c:134
bio_handle_ctx_t::el
fr_event_list_t * el
Event list.
Definition bio.c:49
request_cancel
static void request_cancel(UNUSED connection_t *conn, void *preq_to_reset, trunk_cancel_reason_t reason, UNUSED void *uctx)
Remove the request from any tracking structures.
Definition bio.c:2324
home_server_free
static void home_server_free(void *data)
Definition bio.c:2642
bio_thread_t::num_ports
int num_ports
Definition bio.c:66
protocol_error_reply
static void protocol_error_reply(bio_request_t *u, bio_handle_t *h)
Deal with Protocol-Error replies, and possible negotiation.
Definition bio.c:1841
status_check_reset
static void status_check_reset(bio_handle_t *h, bio_request_t *u)
Reset a status_check packet, ready to reuse.
Definition bio.c:233
io_replicate_funcs
static const trunk_io_funcs_t io_replicate_funcs
Definition bio.c:2661
request_fail
static void request_fail(request_t *request, NDEBUG_UNUSED void *preq, void *rctx, NDEBUG_UNUSED trunk_request_state_t state, UNUSED void *uctx)
Write out a canned failure.
Definition bio.c:2378
bio_request_s::recv_time
fr_time_t recv_time
copied from request->async->recv_time
Definition bio.c:121
bio_request_s::retry
fr_retry_t retry
retransmission timers
Definition bio.c:138
conn_init_writable
static void conn_init_writable(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
xlat_radius_client
static xlat_action_t xlat_radius_client(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *args)
Definition bio.c:2916
bio_handle_t::bio
struct bio_handle_t::@188 bio
bio_request_s::rcode
rlm_rcode_t rcode
from the transport
Definition bio.c:117
status_check_alloc
static void status_check_alloc(bio_handle_t *h)
Definition bio.c:250
bio_handle_t::mrs_time
fr_time_t mrs_time
Most recent sent time which had a reply.
Definition bio.c:98
bio_handle_t::status_checking
bool status_checking
whether we're doing status checks
Definition bio.c:106
bio_handle_ctx_t::trunk
trunk_t * trunk
trunk handler
Definition bio.c:50
bio_handle_t::last_sent
fr_time_t last_sent
last time we sent a packet.
Definition bio.c:101
zombie_timeout
static void zombie_timeout(fr_timer_list_t *tl, fr_time_t now, void *uctx)
Mark a connection dead after "zombie_interval".
Definition bio.c:1369
home_server_t::ctx
bio_handle_ctx_t ctx
for copying to bio_handle_t
Definition bio.c:142
mod_thread_instantiate
static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
Instantiate thread data for the submodule.
Definition bio.c:2676
bio_error
static void bio_error(fr_bio_t *bio)
Definition bio.c:640
status_check_reply
static void status_check_reply(trunk_request_t *treq, fr_time_t now)
Deal with replies replies to status checks and possible negotiation.
Definition bio.c:1971
conn_init_next
static void conn_init_next(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
Perform the next step of init and negotiation.
Definition bio.c:407
bio_request_s::is_retry
bool is_retry
Definition bio.c:118
_bio_request_free
static int _bio_request_free(bio_request_t *u)
Free a bio_request_t.
Definition bio.c:2488
bio_handle_t::conn
connection_t * conn
Definition bio.c:86
bio_handle_t::first_sent
fr_time_t first_sent
first time we sent a packet since going idle
Definition bio.c:100
mod_resume
static unlang_action_t mod_resume(unlang_result_t *p_result, module_ctx_t const *mctx, UNUSED request_t *request)
Resume execution of the request, returning the rcode set during trunk execution.
Definition bio.c:2418
bio_handle_t::zombie_ev
fr_timer_t * zombie_ev
Zombie timeout.
Definition bio.c:104
thread_conn_alloc
static connection_t * thread_conn_alloc(trunk_connection_t *tconn, fr_event_list_t *el, connection_conf_t const *conf, char const *log_prefix, void *uctx)
Definition bio.c:1009
xlat_sendto_retry
static void xlat_sendto_retry(xlat_ctx_t const *xctx, request_t *request, fr_retry_t const *retry)
Definition bio.c:2905
bio_request_reset
static void bio_request_reset(bio_request_t *u)
Clear out any connection specific resources from a udp request.
Definition bio.c:216
bio_request_s::treq
trunk_request_t * treq
Definition bio.c:116
xlat_sendto_resume
static xlat_action_t xlat_sendto_resume(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, UNUSED fr_value_box_list_t *in)
Definition bio.c:2877
status_check_next
static void status_check_next(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
Handle retries for a status check.
Definition bio.c:1956
bio_handle_ctx_t::inst
rlm_radius_t const * inst
our instance
Definition bio.c:48
conn_init
static connection_state_t conn_init(void **h_out, connection_t *conn, void *uctx)
Initialise a new outbound connection.
Definition bio.c:725
bio_thread_t::connections
connection_t ** connections
Definition bio.c:67
home_server_t::expire
fr_rb_expire_node_t expire
Definition bio.c:144
revive_timeout
static void revive_timeout(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
Revive a connection after "revive_interval".
Definition bio.c:1357
bio_request_s::packet
uint8_t * packet
Packet we write to the network.
Definition bio.c:132
conn_init_timeout
static void conn_init_timeout(UNUSED fr_timer_list_t *tl, fr_time_t now, void *uctx)
Status check timer when opening the connection for the first time.
Definition bio.c:359
conn_failed
static connection_state_t conn_failed(void *handle, connection_state_t state, UNUSED void *uctx)
Connection failed.
Definition bio.c:982
bio_handle_ctx_t::limit_source_ports
bio_limit_ports_t limit_source_ports
What type of port limit is in use.
Definition bio.c:54
bio_handle_ctx_t::radius_ctx
fr_radius_ctx_t radius_ctx
for signing packets
Definition bio.c:53
bio_handle_t::tt
radius_track_t * tt
RADIUS ID tracking structure.
Definition bio.c:96
mod_dup
static void mod_dup(request_t *request, bio_request_t *u)
Definition bio.c:1486
bio_handle_t::ctx
bio_handle_ctx_t ctx
common struct for home servers and BIO handles
Definition bio.c:76
home_server_cmp
static int8_t home_server_cmp(void const *one, void const *two)
Dynamic home server code.
Definition bio.c:2865
bio_request_s::code
uint8_t code
Packet code.
Definition bio.c:130
request_mux
static void request_mux(UNUSED fr_event_list_t *el, trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
Definition bio.c:1613
bio_handle_t::buffer
uint8_t * buffer
Receive buffer.
Definition bio.c:93
bio_handle_t::status_request
request_t * status_request
Definition bio.c:108
request_complete
static void request_complete(request_t *request, NDEBUG_UNUSED void *preq, void *rctx, UNUSED void *uctx)
Response has already been written to the rctx at this point.
Definition bio.c:2400
bio_request_s::status_check
bool status_check
is this packet a status check?
Definition bio.c:125
xlat_radius_send_args
static xlat_arg_parser_t const xlat_radius_send_args[]
Definition bio.c:2756
xlat_sendto_signal
static void xlat_sendto_signal(xlat_ctx_t const *xctx, request_t *request, fr_signal_t action)
Definition bio.c:2894
bio_handle_ctx_t
Definition bio.c:46
bio_handle_t
Track the handle, which is tightly correlated with the FD.
Definition bio.c:75
bio_request_s
Connect request_t to local tracking structure.
Definition bio.c:115
bio_thread_t
Definition bio.c:57
home_server_t
Definition bio.c:141
fr_nbo_to_uint16
static uint16_t fr_nbo_to_uint16(uint8_t const data[static sizeof(uint16_t)])
Read an unsigned 16bit integer from wire format (big endian)
Definition nbo.h:146
RADIUS_HEADER_LENGTH
#define RADIUS_HEADER_LENGTH
Definition net.h:80
RADIUS_AUTH_VECTOR_LENGTH
#define RADIUS_AUTH_VECTOR_LENGTH
Definition net.h:89
fr_pair_value_memdup
int fr_pair_value_memdup(fr_pair_t *vp, uint8_t const *src, size_t len, bool tainted)
Copy data into an "octets" data type.
Definition pair.c:2950
fr_pair_value_strdup
int fr_pair_value_strdup(fr_pair_t *vp, char const *src, bool tainted)
Copy data into an "string" data type.
Definition pair.c:2651
fr_pair_find_by_da
fr_pair_t * fr_pair_find_by_da(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find the first pair with a matching da.
Definition pair.c:709
fr_pair_append
int fr_pair_append(fr_pair_list_t *list, fr_pair_t *to_add)
Add a VP to the end of the list.
Definition pair.c:1354
fr_pair_delete_by_da
int fr_pair_delete_by_da(fr_pair_list_t *list, fr_dict_attr_t const *da)
Delete matching pairs from the specified list.
Definition pair.c:1698
fr_pair_afrom_da
fr_pair_t * fr_pair_afrom_da(TALLOC_CTX *ctx, fr_dict_attr_t const *da)
Dynamically allocate a new attribute and assign a fr_dict_attr_t.
Definition pair.c:290
fr_pair_list_init
void fr_pair_list_init(fr_pair_list_t *list)
Initialise a pair list header.
Definition pair.c:46
encode_ctx
static fr_internal_encode_ctx_t encode_ctx
Definition proto_ldap_sync.c:34
attr_error_cause
static fr_dict_attr_t const * attr_error_cause
Definition proto_radius.c:123
fr_radius_decode
ssize_t fr_radius_decode(TALLOC_CTX *ctx, fr_pair_list_t *out, uint8_t *packet, size_t packet_len, fr_radius_decode_ctx_t *decode_ctx)
Definition base.c:1104
fr_radius_sign
int fr_radius_sign(uint8_t *packet, uint8_t const *vector, uint8_t const *secret, size_t secret_len)
Sign a previously encoded packet.
Definition base.c:362
fr_radius_encode
ssize_t fr_radius_encode(fr_dbuff_t *dbuff, fr_pair_list_t *vps, fr_radius_encode_ctx_t *packet_ctx)
Definition base.c:954
fr_radius_packet_name
char const * fr_radius_packet_name[FR_RADIUS_CODE_MAX]
Definition base.c:116
fr_assert
#define fr_assert(_expr)
Definition rad_assert.h:38
secret
static char * secret
Definition radclient-ng.c:71
REDEBUG
#define REDEBUG(fmt,...)
Definition radclient-ng.h:52
RDEBUG
#define RDEBUG(fmt,...)
Definition radclient-ng.h:53
WARN
#define WARN(fmt,...)
Definition radclient-ng.h:47
attr_proxy_state
static fr_dict_attr_t const * attr_proxy_state
Definition radclient.c:130
INFO
#define INFO(fmt,...)
Definition radict.c:64
FR_RADIUS_REQUIRE_MA_YES
@ FR_RADIUS_REQUIRE_MA_YES
Require Message-Authenticator.
Definition radius.h:64
FR_RADIUS_REQUIRE_MA_AUTO
@ FR_RADIUS_REQUIRE_MA_AUTO
Only require Message-Authenticator if we've previously received a packet from this client with Messag...
Definition radius.h:65
RADIUS_AUTH_VECTOR_OFFSET
#define RADIUS_AUTH_VECTOR_OFFSET
Definition radius.h:33
fr_radius_decode_fail_t
fr_radius_decode_fail_t
Failure reasons.
Definition radius.h:90
FR_RADIUS_FAIL_NONE
@ FR_RADIUS_FAIL_NONE
Definition radius.h:91
FR_RADIUS_FAIL_MA_MISSING
@ FR_RADIUS_FAIL_MA_MISSING
Definition radius.h:109
FR_RADIUS_FAIL_UNKNOWN_PACKET_CODE
@ FR_RADIUS_FAIL_UNKNOWN_PACKET_CODE
Definition radius.h:96
fr_radius_ctx_t::secret
char const * secret
Definition radius.h:127
fr_radius_ctx_t::secret_length
size_t secret_length
Definition radius.h:128
fr_radius_decode_ctx_t::common
fr_radius_ctx_t const * common
Definition radius.h:160
fr_radius_decode_ctx_t::reason
fr_radius_decode_fail_t reason
reason for decode failure
Definition radius.h:167
fr_radius_decode_ctx_t::tmp_ctx
TALLOC_CTX * tmp_ctx
for temporary things cleaned up during decoding
Definition radius.h:164
fr_radius_ctx_t
Definition radius.h:126
fr_radius_decode_ctx_t
Definition radius.h:159
fr_radius_encode_ctx_t
Definition radius.h:135
dict_radius
static fr_dict_t const * dict_radius
Definition radsniff.c:94
conf
static rs_t * conf
Definition radsniff.c:53
attr_extended_attribute_1
static fr_dict_attr_t const * attr_extended_attribute_1
Definition radsnmp.c:110
attr_message_authenticator
static fr_dict_attr_t const * attr_message_authenticator
Definition radsnmp.c:114
fr_rand
uint32_t fr_rand(void)
Return a 32-bit random number.
Definition rand.c:105
fr_fast_rand_t
Smaller fast random number generator.
Definition rand.h:54
fr_rb_find
void * fr_rb_find(fr_rb_tree_t const *tree, void const *data)
Find an element in the tree, returning the data, not the node.
Definition rb.c:577
fr_rb_delete
bool fr_rb_delete(fr_rb_tree_t *tree, void const *data)
Remove node and free data (if a free function was specified)
Definition rb.c:741
fr_rb_expire_insert
bool fr_rb_expire_insert(fr_rb_expire_t *expire, void *data, fr_time_t now)
Attempt to find current data in the tree, if it does not exist insert it.
Definition rb_expire.c:39
fr_rb_expire_update
void fr_rb_expire_update(fr_rb_expire_t *expire, void *data, fr_time_t now)
Definition rb_expire.c:57
fr_rb_expire_inline_talloc_init
#define fr_rb_expire_inline_talloc_init(_expire, _type, _field, _data_cmp, _data_free, _lifetime)
Definition rb_expire.h:50
fr_rb_expire_t::head
fr_dlist_head_t head
Definition rb_expire.h:35
fr_rb_expire_node_t::when
fr_time_t when
Definition rb_expire.h:47
fr_rb_expire_t::tree
fr_rb_tree_t tree
Definition rb_expire.h:34
fr_rb_expire_node_t
dlist for expiring old entries
Definition rb_expire.h:44
fr_rb_expire_t
Definition rb_expire.h:33
RETURN_UNLANG_RCODE
#define RETURN_UNLANG_RCODE(_rcode)
Definition rcode.h:61
rlm_rcode_t
rlm_rcode_t
Return codes indicating the result of the module call.
Definition rcode.h:44
RLM_MODULE_OK
@ RLM_MODULE_OK
The module is OK, continue.
Definition rcode.h:49
RLM_MODULE_FAIL
@ RLM_MODULE_FAIL
Module failed, don't reply.
Definition rcode.h:48
RLM_MODULE_REJECT
@ RLM_MODULE_REJECT
Immediately reject the request.
Definition rcode.h:47
RLM_MODULE_UPDATED
@ RLM_MODULE_UPDATED
OK (pairs modified).
Definition rcode.h:55
RLM_MODULE_HANDLED
@ RLM_MODULE_HANDLED
The module handled the request, so stop.
Definition rcode.h:50
request_local_alloc_external
#define request_local_alloc_external(_ctx, _args)
Allocate a new external request outside of the request pool.
Definition request.h:335
request_init_args_t
Optional arguments for initialising requests.
Definition request.h:287
radius_fixups
static int radius_fixups(rlm_radius_t const *inst, request_t *request)
Do any RADIUS-layer fixups for proxying.
Definition rlm_radius.c:514
attr_nas_identifier
static fr_dict_attr_t const * attr_nas_identifier
Definition rlm_radius.c:191
attr_original_packet_code
static fr_dict_attr_t const * attr_original_packet_code
Definition rlm_radius.c:192
attr_event_timestamp
static fr_dict_attr_t const * attr_event_timestamp
Definition rlm_radius.c:187
attr_response_length
static fr_dict_attr_t const * attr_response_length
Definition rlm_radius.c:193
rlm_radius_s::require_message_authenticator
fr_radius_require_ma_t require_message_authenticator
Require Message-Authenticator in responses.
Definition rlm_radius.h:75
rlm_radius_s::revive_interval
fr_time_delta_t revive_interval
Definition rlm_radius.h:60
rlm_radius_s::retry
fr_retry_config_t retry[FR_RADIUS_CODE_MAX]
Definition rlm_radius.h:87
rlm_radius_s::name
char const * name
Definition rlm_radius.h:56
rlm_radius_s::status_check
uint32_t status_check
code of status-check type
Definition rlm_radius.h:79
rlm_radius_s::mode
rlm_radius_mode_t mode
proxy, client, etc.
Definition rlm_radius.h:71
RLM_RADIUS_MODE_XLAT_PROXY
@ RLM_RADIUS_MODE_XLAT_PROXY
radius.sendto.ipaddr(), but we do look for a reply.
Definition rlm_radius.h:47
RLM_RADIUS_MODE_INVALID
@ RLM_RADIUS_MODE_INVALID
Definition rlm_radius.h:42
RLM_RADIUS_MODE_PROXY
@ RLM_RADIUS_MODE_PROXY
we proxy to one home server
Definition rlm_radius.h:43
RLM_RADIUS_MODE_REPLICATE
@ RLM_RADIUS_MODE_REPLICATE
to a particular destination
Definition rlm_radius.h:45
RLM_RADIUS_MODE_UNCONNECTED_REPLICATE
@ RLM_RADIUS_MODE_UNCONNECTED_REPLICATE
radius.sendto.ipaddr(), but we don't look for a reply
Definition rlm_radius.h:46
RLM_RADIUS_MODE_CLIENT
@ RLM_RADIUS_MODE_CLIENT
we are a client to one home server
Definition rlm_radius.h:44
rlm_radius_s::max_packet_size
uint32_t max_packet_size
Maximum packet size.
Definition rlm_radius.h:66
rlm_radius_s::response_window
fr_time_delta_t response_window
Definition rlm_radius.h:58
rlm_radius_s::max_attributes
uint32_t max_attributes
Maximum number of attributes to decode in response.
Definition rlm_radius.h:73
rlm_radius_s::zombie_period
fr_time_delta_t zombie_period
Definition rlm_radius.h:59
rlm_radius_s
Definition rlm_radius.h:53
retry_config
static conf_parser_t retry_config[]
Definition rlm_tacacs.c:39
fr_schedule_worker_id
int fr_schedule_worker_id(void)
Return the worker id for the current thread.
Definition schedule.c:157
connection_signal_reconnect
void connection_signal_reconnect(connection_t *conn, connection_reason_t reason)
Asynchronously signal the connection should be reconnected.
Definition connection.c:1169
connection_signal_on_fd
int connection_signal_on_fd(connection_t *conn, int fd)
Setup the connection to change states to connected or failed based on I/O events.
Definition connection.c:1409
connection_alloc
connection_t * connection_alloc(TALLOC_CTX *ctx, fr_event_list_t *el, connection_funcs_t const *funcs, connection_conf_t const *conf, char const *log_prefix, void const *uctx)
Allocate a new connection.
Definition connection.c:1517
connection_signal_connected
void connection_signal_connected(connection_t *conn)
Asynchronously signal that the connection is open.
Definition connection.c:1139
connection_s
Definition connection.c:87
module_instance_s::data
void * data
Module's instance data.
Definition module.h:291
pair_append_request
#define pair_append_request(_attr, _da)
Allocate and append a fr_pair_t to the request list.
Definition pair.h:37
fr_signal_t
fr_signal_t
Signals that can be generated/processed by request signal handlers.
Definition signal.h:38
FR_SIGNAL_DUP
@ FR_SIGNAL_DUP
A duplicate request was received.
Definition signal.h:44
FR_SIGNAL_CANCEL
@ FR_SIGNAL_CANCEL
Request has been cancelled.
Definition signal.h:40
inst
eap_aka_sim_process_conf_t * inst
Definition state_machine.c:3647
vp
fr_pair_t * vp
Definition state_machine.c:2289
fr_log_s
Definition log.h:96
map_s
Value pair map.
Definition map.h:77
pair_list_s
Definition pair.h:52
value_pair_s
Stores an attribute, a value and various bits of other data.
Definition pair.h:68
fr_syserror
char const * fr_syserror(int num)
Guaranteed to be thread-safe version of strerror.
Definition syserror.c:243
talloc_get_type_abort_const
#define talloc_get_type_abort_const
Definition talloc.h:113
talloc_const_free
static int talloc_const_free(void const *ptr)
Free const'd memory.
Definition talloc.h:259
talloc_strdup
#define talloc_strdup(_ctx, _str)
Definition talloc.h:145
fr_time_gteq
#define fr_time_gteq(_a, _b)
Definition time.h:238
fr_time_wrap
#define fr_time_wrap(_time)
Definition time.h:145
fr_time_lteq
#define fr_time_lteq(_a, _b)
Definition time.h:240
fr_time_eq
#define fr_time_eq(_a, _b)
Definition time.h:241
fr_time_add
#define fr_time_add(_a, _b)
Add a time/time delta together.
Definition time.h:196
fr_time_gt
#define fr_time_gt(_a, _b)
Definition time.h:237
fr_time_sub
#define fr_time_sub(_a, _b)
Subtract one time from another.
Definition time.h:229
fr_time_to_unix_time
static fr_unix_time_t fr_time_to_unix_time(fr_time_t when)
Convert an fr_time_t (internal time) to our version of unix time (wallclock time)
Definition time.h:688
fr_time_lt
#define fr_time_lt(_a, _b)
Definition time.h:239
fr_time_cmp
static int8_t fr_time_cmp(fr_time_t a, fr_time_t b)
Compare two fr_time_t values.
Definition time.h:916
fr_time_s
"server local" time.
Definition time.h:69
fr_timer_list_s
An event timer list.
Definition timer.c:50
fr_timer_s
A timer event.
Definition timer.c:84
FR_TIMER_DELETE_RETURN
#define FR_TIMER_DELETE_RETURN(_ev_p)
Definition timer.h:110
FR_TIMER_DISARM
#define FR_TIMER_DISARM(_ev)
Definition timer.h:91
fr_timer_armed
static bool fr_timer_armed(fr_timer_t *ev)
Definition timer.h:120
fr_timer_at
#define fr_timer_at(...)
Definition timer.h:81
radius_track_state_log
void radius_track_state_log(fr_log_t const *log, fr_log_type_t log_type, char const *file, int line, radius_track_t *tt, radius_track_log_extra_t extra)
Print out the state of every tracking entry.
Definition track.c:294
radius_track_entry_update
int radius_track_entry_update(radius_track_entry_t *te, uint8_t const *vector)
Update a tracking entry with the authentication vector.
Definition track.c:219
radius_track_entry_find
radius_track_entry_t * radius_track_entry_find(radius_track_t *tt, uint8_t packet_id, uint8_t const *vector)
Find a tracking entry from a request authenticator.
Definition track.c:248
radius_track_alloc
radius_track_t * radius_track_alloc(TALLOC_CTX *ctx)
Create an radius_track_t.
Definition track.c:41
radius_track_entry_release
#define radius_track_entry_release(_te)
Definition track.h:90
radius_track_entry_s::uctx
void * uctx
Result/resumption context.
Definition track.h:47
radius_track_entry_s::id
uint8_t id
our ID
Definition track.h:50
radius_track_s::num_requests
unsigned int num_requests
number of requests in the allocation
Definition track.h:65
radius_track_entry_reserve
#define radius_track_entry_reserve(_te_out, _ctx, _tt, _request, _code, _uctx)
Definition track.h:82
radius_track_entry_s::request
request_t * request
as always...
Definition track.h:45
radius_track_entry_s
Track one request to a response.
Definition track.h:36
radius_track_s
Definition track.h:64
trunk_connection_callback_readable
void trunk_connection_callback_readable(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
Standard I/O read function.
Definition trunk.c:4035
trunk_connection_callback_writable
void trunk_connection_callback_writable(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
Standard I/O write function.
Definition trunk.c:4052
trunk_request_signal_partial
void trunk_request_signal_partial(trunk_request_t *treq)
Signal a partial write.
Definition trunk.c:2047
trunk_request_signal_fail
void trunk_request_signal_fail(trunk_request_t *treq)
Signal that a trunk request failed.
Definition trunk.c:2150
trunk_request_alloc
trunk_request_t * trunk_request_alloc(trunk_t *trunk, request_t *request)
(Pre-)Allocate a new trunk request
Definition trunk.c:2494
trunk_connection_requests_requeue
uint64_t trunk_connection_requests_requeue(trunk_connection_t *tconn, int states, uint64_t max, bool fail_bound)
Move requests off of a connection and requeue elsewhere.
Definition trunk.c:2028
trunk_request_enqueue_on_conn
trunk_enqueue_t trunk_request_enqueue_on_conn(trunk_request_t **treq_out, trunk_connection_t *tconn, request_t *request, void *preq, void *rctx, bool ignore_limits)
Enqueue additional requests on a specific connection.
Definition trunk.c:2761
trunk_request_enqueue
trunk_enqueue_t trunk_request_enqueue(trunk_request_t **treq_out, trunk_t *trunk, request_t *request, void *preq, void *rctx)
Enqueue a request that needs data written to the trunk.
Definition trunk.c:2607
trunk_request_requeue
trunk_enqueue_t trunk_request_requeue(trunk_request_t *treq)
Re-enqueue a request on the same connection.
Definition trunk.c:2696
trunk_connection_pop_request
int trunk_connection_pop_request(trunk_request_t **treq_out, trunk_connection_t *tconn)
Pop a request off a connection's pending queue.
Definition trunk.c:3904
trunk_request_signal_cancel
void trunk_request_signal_cancel(trunk_request_t *treq)
Cancel a trunk request.
Definition trunk.c:2170
trunk_alloc
trunk_t * trunk_alloc(TALLOC_CTX *ctx, fr_event_list_t *el, trunk_io_funcs_t const *funcs, trunk_conf_t const *conf, char const *log_prefix, void const *uctx, bool delay_start, fr_pair_list_t *trigger_args)
Allocate a new collection of connections.
Definition trunk.c:4969
trunk_request_free
void trunk_request_free(trunk_request_t **treq_to_free)
If the trunk request is freed then update the target requests.
Definition trunk.c:2340
trunk_connection_signal_active
void trunk_connection_signal_active(trunk_connection_t *tconn)
Signal a trunk connection is no longer full.
Definition trunk.c:3981
trunk_connection_signal_inactive
void trunk_connection_signal_inactive(trunk_connection_t *tconn)
Signal a trunk connection cannot accept more requests.
Definition trunk.c:3958
trunk_request_signal_sent
void trunk_request_signal_sent(trunk_request_t *treq)
Signal that the request was written to a connection successfully.
Definition trunk.c:2068
trunk_request_signal_complete
void trunk_request_signal_complete(trunk_request_t *treq)
Signal that a trunk request is complete.
Definition trunk.c:2112
trunk_connection_signal_reconnect
void trunk_connection_signal_reconnect(trunk_connection_t *tconn, connection_reason_t reason)
Signal a trunk connection is no longer viable.
Definition trunk.c:4020
trunk_request_state_log
void trunk_request_state_log(fr_log_t const *log, fr_log_type_t log_type, char const *file, int line, trunk_request_t const *treq)
Definition trunk.c:2849
trunk_connection_s
Associates request queues with a connection.
Definition trunk.c:133
trunk_request_s
Wraps a normal request.
Definition trunk.c:99
trunk_s
Main trunk management handle.
Definition trunk.c:215
TRUNK_REQUEST_STATE_ALL
#define TRUNK_REQUEST_STATE_ALL
All request states.
Definition trunk.h:196
trunk_io_funcs_t::connection_alloc
trunk_connection_alloc_t connection_alloc
Allocate a new connection_t.
Definition trunk.h:738
trunk_connection_event_t
trunk_connection_event_t
What type of I/O events the trunk connection is currently interested in receiving.
Definition trunk.h:72
TRUNK_CONN_EVENT_BOTH
@ TRUNK_CONN_EVENT_BOTH
Trunk should be notified if a connection is readable or writable.
Definition trunk.h:79
TRUNK_CONN_EVENT_WRITE
@ TRUNK_CONN_EVENT_WRITE
Trunk should be notified if a connection is writable.
Definition trunk.h:77
TRUNK_CONN_EVENT_NONE
@ TRUNK_CONN_EVENT_NONE
Don't notify the trunk on connection state changes.
Definition trunk.h:73
TRUNK_CONN_EVENT_READ
@ TRUNK_CONN_EVENT_READ
Trunk should be notified if a connection is readable.
Definition trunk.h:75
trunk_cancel_reason_t
trunk_cancel_reason_t
Reasons for a request being cancelled.
Definition trunk.h:55
TRUNK_CANCEL_REASON_REQUEUE
@ TRUNK_CANCEL_REASON_REQUEUE
A previously sent request is being requeued.
Definition trunk.h:59
TRUNK_ENQUEUE_DST_UNAVAILABLE
@ TRUNK_ENQUEUE_DST_UNAVAILABLE
Destination is down.
Definition trunk.h:154
TRUNK_ENQUEUE_FAIL
@ TRUNK_ENQUEUE_FAIL
General failure.
Definition trunk.h:155
TRUNK_ENQUEUE_OK
@ TRUNK_ENQUEUE_OK
Operation was successful.
Definition trunk.h:151
TRUNK_ENQUEUE_NO_CAPACITY
@ TRUNK_ENQUEUE_NO_CAPACITY
At maximum number of connections, and no connection has capacity.
Definition trunk.h:152
TRUNK_ENQUEUE_IN_BACKLOG
@ TRUNK_ENQUEUE_IN_BACKLOG
Request should be enqueued in backlog.
Definition trunk.h:150
trunk_request_state_t
trunk_request_state_t
Used for sanity checks and to simplify freeing.
Definition trunk.h:162
TRUNK_REQUEST_STATE_PARTIAL
@ TRUNK_REQUEST_STATE_PARTIAL
Some of the request was written to the socket, more of it should be written later.
Definition trunk.h:171
TRUNK_REQUEST_STATE_REAPABLE
@ TRUNK_REQUEST_STATE_REAPABLE
Request has been written, needs to persist, but we are not currently waiting for any response.
Definition trunk.h:174
TRUNK_REQUEST_STATE_UNASSIGNED
@ TRUNK_REQUEST_STATE_UNASSIGNED
Transition state - Request currently not assigned to any connection.
Definition trunk.h:166
TRUNK_REQUEST_STATE_INIT
@ TRUNK_REQUEST_STATE_INIT
Initial state.
Definition trunk.h:163
TRUNK_REQUEST_STATE_CANCEL_SENT
@ TRUNK_REQUEST_STATE_CANCEL_SENT
We've informed the remote server that the request has been cancelled.
Definition trunk.h:186
TRUNK_REQUEST_STATE_COMPLETE
@ TRUNK_REQUEST_STATE_COMPLETE
The request is complete.
Definition trunk.h:183
TRUNK_REQUEST_STATE_FAILED
@ TRUNK_REQUEST_STATE_FAILED
The request failed.
Definition trunk.h:184
TRUNK_REQUEST_STATE_CANCEL
@ TRUNK_REQUEST_STATE_CANCEL
A request on a particular socket was cancel.
Definition trunk.h:185
TRUNK_REQUEST_STATE_CANCEL_PARTIAL
@ TRUNK_REQUEST_STATE_CANCEL_PARTIAL
We partially wrote a cancellation request.
Definition trunk.h:188
TRUNK_REQUEST_STATE_BACKLOG
@ TRUNK_REQUEST_STATE_BACKLOG
In the backlog.
Definition trunk.h:168
TRUNK_REQUEST_STATE_CANCEL_COMPLETE
@ TRUNK_REQUEST_STATE_CANCEL_COMPLETE
Remote server has acknowledged our cancellation.
Definition trunk.h:189
TRUNK_REQUEST_STATE_PENDING
@ TRUNK_REQUEST_STATE_PENDING
In the queue of a connection and is pending writing.
Definition trunk.h:169
TRUNK_REQUEST_STATE_SENT
@ TRUNK_REQUEST_STATE_SENT
Was written to a socket. Waiting for a response.
Definition trunk.h:173
trunk_io_funcs_t
I/O functions to pass to trunk_alloc.
Definition trunk.h:737
el
static fr_event_list_t * el
Definition unit_test_attribute.c:281
unlang_xlat_yield_to_retry
xlat_action_t unlang_xlat_yield_to_retry(request_t *request, xlat_func_t resume, fr_unlang_xlat_retry_t retry, xlat_func_signal_t signal, fr_signal_t sigmask, void *rctx, fr_retry_config_t const *retry_cfg)
Yield a request back to the interpreter, with retries.
Definition xlat.c:664
XLAT_ARGS
#define XLAT_ARGS(_list,...)
Populate local variables with value boxes from the input list.
Definition xlat.h:383
xlat_arg_parser_t::required
unsigned int required
Argument must be present, and non-empty.
Definition xlat.h:146
XLAT_ARG_PARSER_TERMINATOR
#define XLAT_ARG_PARSER_TERMINATOR
Definition xlat.h:170
xlat_action_t
xlat_action_t
Definition xlat.h:37
XLAT_ACTION_FAIL
@ XLAT_ACTION_FAIL
An xlat function failed.
Definition xlat.h:44
XLAT_ACTION_DONE
@ XLAT_ACTION_DONE
We're done evaluating this level of nesting.
Definition xlat.h:43
xlat_arg_parser_t
Definition for a single argument consumend by an xlat function.
Definition xlat.h:145
fr_pair_list_empty
bool fr_pair_list_empty(fr_pair_list_t const *list)
Is a valuepair list empty.
Definition pair_inline.c:124
fr_pair_list_free
void fr_pair_list_free(fr_pair_list_t *list)
Free memory used by a valuepair list.
Definition pair_inline.c:112
fr_pair_list_append
void fr_pair_list_append(fr_pair_list_t *dst, fr_pair_list_t *src)
Appends a list of fr_pair_t from a temporary list to a destination list.
Definition pair_inline.c:181
fr_retry_next
fr_retry_state_t fr_retry_next(fr_retry_t *r, fr_time_t now)
Initialize a retransmission counter.
Definition retry.c:110
fr_retry_init
void fr_retry_init(fr_retry_t *r, fr_time_t now, fr_retry_config_t const *config)
Initialize a retransmission counter.
Definition retry.c:36
fr_retry_t::start
fr_time_t start
when we started the retransmission
Definition retry.h:53
fr_retry_t::rt
fr_time_delta_t rt
retransmit interval
Definition retry.h:57
fr_retry_config_t::mrc
uint32_t mrc
Maximum retransmission count.
Definition retry.h:36
fr_retry_t::config
fr_retry_config_t const * config
master configuration
Definition retry.h:52
fr_retry_t::state
fr_retry_state_t state
so callers can see what state it's in.
Definition retry.h:60
FR_RETRY_MRC
@ FR_RETRY_MRC
reached maximum retransmission count
Definition retry.h:47
FR_RETRY_CONTINUE
@ FR_RETRY_CONTINUE
Definition retry.h:46
FR_RETRY_MRD
@ FR_RETRY_MRD
reached maximum retransmission duration
Definition retry.h:48
fr_retry_t::count
uint32_t count
number of sent packets
Definition retry.h:58
fr_retry_config_t::mrd
fr_time_delta_t mrd
Maximum retransmission duration.
Definition retry.h:35
fr_retry_t::updated
fr_time_t updated
last update, really a cached "now".
Definition retry.h:56
fr_retry_t::next
fr_time_t next
when the next timer should be set
Definition retry.h:55
fr_retry_config_t
Definition retry.h:32
fr_retry_t
Definition retry.h:51
fr_socket_t::af
int af
AF_INET, AF_INET6, or AF_UNIX.
Definition socket.h:78
fr_socket_t::fd
int fd
File descriptor if this is a live socket.
Definition socket.h:81
fr_strerror
char const * fr_strerror(void)
Get the last library error.
Definition strerror.c:553
fr_value_box_alloc
#define fr_value_box_alloc(_ctx, _type, _enumv)
Allocate a value box of a specific type.
Definition value.h:644
fr_box_ipaddr
#define fr_box_ipaddr(_val)
Definition value.h:317
data
static fr_slen_t data
Definition value.h:1340
fr_box_time_delta
#define fr_box_time_delta(_val)
Definition value.h:366
nonnull
int nonnull(2, 5))
out
static size_t char ** out
Definition value.h:1030
xlat_ctx_s::rctx
void * rctx
Resume context.
Definition xlat_ctx.h:54
xlat_ctx_s::mctx
module_ctx_t const * mctx
Synthesised module calling ctx.
Definition xlat_ctx.h:52
xlat_ctx_s
An xlat calling ctx.
Definition xlat_ctx.h:49
Generated by   doxygen 1.9.8