The FreeRADIUS server $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
Loading...
Searching...
No Matches
bio.c
Go to the documentation of this file.
1/*
2 * This program is is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License as published by
4 * the Free Software Foundation; either version 2 of the License, or (at
5 * your option) any later version.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
15 */
16
17/**
18 * $Id: 4f36a03b2fa03768ffe99ba8cdc5ab2fc0dab92a $
19 * @file src/modules/rlm_radius/bio.c
20 * @brief RADIUS BIO transport
21 *
22 * @copyright 2017 Network RADIUS SAS
23 * @copyright 2020 Arran Cudbard-Bell (a.cudbardb@freeradius.org)
24 */
25
26#include <freeradius-devel/io/application.h>
27#include <freeradius-devel/io/listen.h>
28#include <freeradius-devel/io/pair.h>
29#include <freeradius-devel/missing.h>
30#include <freeradius-devel/server/connection.h>
31#include <freeradius-devel/util/debug.h>
32#include <freeradius-devel/util/heap.h>
33#include <freeradius-devel/util/rb_expire.h>
34
35#include <sys/socket.h>
36
37//#include "rlm_radius.h"
38#include "track.h"
39
40/*
41 * Macro to simplify checking packets before calling decode(), so that
42 * it gets a known valid length and no longer calls fr_radius_ok() itself.
43 */
44#define check(_handle, _len_p) fr_radius_ok((_handle)->buffer, (size_t *)(_len_p), \
45 (_handle)->ctx.inst->max_attributes, false, NULL)
46
47typedef struct {
48 char const *module_name; //!< the module that opened the connection
49 rlm_radius_t const *inst; //!< our instance
50 fr_event_list_t *el; //!< Event list.
51 trunk_t *trunk; //!< trunk handler
52 fr_bio_fd_config_t fd_config; //!< for threads or sockets
53 fr_bio_fd_info_t const *fd_info; //!< status of the FD.
54 fr_radius_ctx_t radius_ctx;
55} bio_handle_ctx_t;
56
57typedef struct {
58 bio_handle_ctx_t ctx; //!< common struct for home servers and BIO handles
59
60 struct {
61 fr_bio_t *fd; //!< writing
62 uint32_t id; //!< for replication
63 fr_rb_expire_t expires; //!< for proxying / client sending
64 } bio;
65} bio_thread_t;
66
67typedef struct bio_request_s bio_request_t;
68
69/** Track the handle, which is tightly correlated with the FD
70 *
71 */
72typedef struct {
73 bio_handle_ctx_t ctx; //!< common struct for home servers and BIO handles
74
75 int fd; //!< File descriptor.
76
77 struct {
78 fr_bio_t *read; //!< what we use for input
79 fr_bio_t *write; //!< what we use for output
80 fr_bio_t *fd; //!< raw FD
81 fr_bio_t *mem; //!< memory wrappers for stream sockets
82 } bio;
83
84 connection_t *conn;
85
86 uint8_t last_id; //!< Used when replicating to ensure IDs are distributed
87 ///< evenly.
88
89 uint32_t max_packet_size; //!< Our max packet size. may be different from the parent.
90
91 uint8_t *buffer; //!< Receive buffer.
92 size_t buflen; //!< Receive buffer length.
93
94 radius_track_t *tt; //!< RADIUS ID tracking structure.
95
96 fr_time_t mrs_time; //!< Most recent sent time which had a reply.
97 fr_time_t last_reply; //!< When we last received a reply.
98 fr_time_t first_sent; //!< first time we sent a packet since going idle
99 fr_time_t last_sent; //!< last time we sent a packet.
100 fr_time_t last_idle; //!< last time we had nothing to do
101
102 fr_timer_t *zombie_ev; //!< Zombie timeout.
103
104 bool status_checking; //!< whether we're doing status checks
105 bio_request_t *status_u; //!< for sending status check packets
106 request_t *status_request;
107} bio_handle_t;
108
109
110/** Connect request_t to local tracking structure
111 *
112 */
113struct bio_request_s {
114 trunk_request_t *treq;
115 rlm_rcode_t rcode; //!< from the transport
116 bool is_retry;
117
118 uint32_t priority; //!< copied from request->async->priority
119 fr_time_t recv_time; //!< copied from request->async->recv_time
120
121 uint32_t num_replies; //!< number of reply packets, sent is in retry.count
122
123 bool status_check; //!< is this packet a status check?
124 bool proxied; //!< is this request being proxied
125
126 fr_pair_list_t extra; //!< VPs for debugging, like Proxy-State.
127
128 uint8_t code; //!< Packet code.
129 uint8_t id; //!< Last ID assigned to this packet.
130 uint8_t *packet; //!< Packet we write to the network.
131 size_t packet_len; //!< Length of the packet.
132 size_t partial; //!< partially sent data
133
134 radius_track_entry_t *rr; //!< ID tracking, resend count, etc.
135 fr_timer_t *ev; //!< timer for retransmissions
136 fr_retry_t retry; //!< retransmission timers
137};
138
139typedef struct {
140 bio_handle_ctx_t ctx; //!< for copying to bio_handle_t
141
142 fr_rb_expire_node_t expire;
143} home_server_t;
144
145/** Turn a reply code into a module rcode;
146 *
147 */
163
164static void conn_init_writable(UNUSED fr_event_list_t *el, UNUSED int fd,
165 UNUSED int flags, void *uctx);
166
167static int encode(bio_handle_t *h, request_t *request, bio_request_t *u, uint8_t id);
168
169static fr_radius_decode_fail_t decode(TALLOC_CTX *ctx, fr_pair_list_t *reply, uint8_t *response_code,
170 bio_handle_t *h, request_t *request, bio_request_t *u,
171 uint8_t const request_authenticator[static RADIUS_AUTH_VECTOR_LENGTH],
172 uint8_t *data, size_t data_len);
173
174static void protocol_error_reply(bio_request_t *u, bio_handle_t *h);
175
176static void mod_write(request_t *request, trunk_request_t *treq, bio_handle_t *h);
177
178static int _bio_request_free(bio_request_t *u);
179
180static int8_t home_server_cmp(void const *one, void const *two);
181
182#ifndef NDEBUG
183/** Log additional information about a tracking entry
184 *
185 * @param[in] te Tracking entry we're logging information for.
186 * @param[in] log destination.
187 * @param[in] log_type Type of log message.
188 * @param[in] file the logging request was made in.
189 * @param[in] line logging request was made on.
190 */
191static void bio_tracking_entry_log(fr_log_t const *log, fr_log_type_t log_type, char const *file, int line,
192 radius_track_entry_t *te)
193{
194 request_t *request;
195
196 if (!te->request) return; /* Free entry */
197
198 request = talloc_get_type_abort(te->request, request_t);
199
200 fr_log(log, log_type, file, line, "request %s, allocated %s:%d", request->name,
201 request->alloc_file, request->alloc_line);
202
203 trunk_request_state_log(log, log_type, file, line, talloc_get_type_abort(te->uctx, trunk_request_t));
204}
205#endif
206
207/** Clear out any connection specific resources from a udp request
208 *
209 */
210static void bio_request_reset(bio_request_t *u)
211{
212 TALLOC_FREE(u->packet);
213 fr_pair_list_free(&u->extra);
214
215 /*
216 * Can have packet put no u->rr
217 * if this is part of a pre-trunk status check.
218 */
219 if (u->rr) radius_track_entry_release(&u->rr);
220
221 fr_assert(!u->ev);
222}
223
224/** Reset a status_check packet, ready to reuse
225 *
226 */
227static void status_check_reset(bio_handle_t *h, bio_request_t *u)
228{
229 fr_assert(u->status_check == true);
230
231 h->status_checking = false;
232 u->num_replies = 0; /* Reset */
233 u->retry.start = fr_time_wrap(0);
234
235 FR_TIMER_DISARM(u->ev);
236
237 bio_request_reset(u);
238}
239
240/*
241 * Status-Server checks. Manually build the packet, and
242 * all of its associated glue.
243 */
244static void CC_HINT(nonnull) status_check_alloc(bio_handle_t *h)
245{
246 bio_request_t *u;
247 request_t *request;
248 rlm_radius_t const *inst = h->ctx.inst;
249 map_t *map = NULL;
250
251 fr_assert(!h->status_u && !h->status_request);
252
253 MEM(request = request_local_alloc_external(h, (&(request_init_args_t){ .namespace = dict_radius })));
254 MEM(u = talloc_zero(request, bio_request_t));
255 talloc_set_destructor(u, _bio_request_free);
256
257 h->status_u = u;
258
259 h->status_request = request;
260 fr_pair_list_init(&u->extra);
261
262 /*
263 * Status checks are prioritized over any other packet
264 */
265 u->priority = ~(uint32_t) 0;
266 u->status_check = true;
267
268 /*
269 * Allocate outside of the free list.
270 * There appears to be an issue where
271 * the thread destructor runs too
272 * early, and frees the freelist's
273 * head before the module destructor
274 * runs.
275 */
276 request->async = talloc_zero(request, fr_async_t);
277 talloc_const_free(request->name);
278 request->name = talloc_strdup(request, h->ctx.module_name);
279
280 request->packet = fr_packet_alloc(request, false);
281 request->reply = fr_packet_alloc(request, false);
282
283 /*
284 * Create the VPs, and ignore any errors
285 * creating them.
286 */
287 while ((map = map_list_next(&inst->status_check_map, map))) {
288 (void) map_to_request(request, map, map_to_vp, NULL);
289 }
290
291 /*
292 * Ensure that there's a NAS-Identifier, if one wasn't
293 * already added.
294 */
295 if (!fr_pair_find_by_da(&request->request_pairs, NULL, attr_nas_identifier)) {
296 fr_pair_t *vp;
297
298 MEM(pair_append_request(&vp, attr_nas_identifier) >= 0);
299 fr_pair_value_strdup(vp, "status check - are you alive?", false);
300 }
301
302 /*
303 * Always add an Event-Timestamp, which will be the time
304 * at which the first packet is sent. Or for
305 * Status-Server, the time of the current packet.
306 */
307 if (!fr_pair_find_by_da(&request->request_pairs, NULL, attr_event_timestamp)) {
308 MEM(pair_append_request(NULL, attr_event_timestamp) >= 0);
309 }
310
311 /*
312 * Initialize the request IO ctx. Note that we don't set
313 * destructors.
314 */
315 u->code = inst->status_check;
316 request->packet->code = u->code;
317
318 DEBUG3("%s - Status check packet type will be %s", h->ctx.module_name, fr_radius_packet_name[u->code]);
319 log_request_pair_list(L_DBG_LVL_3, request, NULL, &request->request_pairs, NULL);
320}
321
322/** Connection errored
323 *
324 * We were signalled by the event loop that a fatal error occurred on this connection.
325 *
326 * @param[in] el The event list signalling.
327 * @param[in] fd that errored.
328 * @param[in] flags El flags.
329 * @param[in] fd_errno The nature of the error.
330 * @param[in] uctx The trunk connection handle (tconn).
331 */
332static void conn_init_error(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, void *uctx)
333{
334 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
335 bio_handle_t *h;
336
337 /*
338 * Connection must be in the connecting state when this fires
339 */
340 fr_assert(conn->state == CONNECTION_STATE_CONNECTING);
341
342 h = talloc_get_type_abort(conn->h, bio_handle_t);
343
344 ERROR("%s - Connection %s failed: %s", h->ctx.module_name, h->ctx.fd_info->name, fr_syserror(fd_errno));
345
346 connection_signal_reconnect(conn, CONNECTION_FAILED);
347}
348
349/** Status check timer when opening the connection for the first time.
350 *
351 * Setup retries, or fail the connection.
352 */
353static void conn_init_timeout(UNUSED fr_timer_list_t *tl, fr_time_t now, void *uctx)
354{
355 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
356 bio_handle_t *h;
357 bio_request_t *u;
358
359 /*
360 * Connection must be in the connecting state when this fires
361 */
362 fr_assert(conn->state == CONNECTION_STATE_CONNECTING);
363
364 h = talloc_get_type_abort(conn->h, bio_handle_t);
365 u = h->status_u;
366
367 /*
368 * We're only interested in contiguous, good, replies.
369 */
370 u->num_replies = 0;
371
372 switch (fr_retry_next(&u->retry, now)) {
373 case FR_RETRY_MRD:
374 DEBUG("%s - Reached maximum_retransmit_duration (%pVs > %pVs), failing status checks",
375 h->ctx.module_name, fr_box_time_delta(fr_time_sub(now, u->retry.start)),
376 fr_box_time_delta(u->retry.config->mrd));
377 goto fail;
378
379 case FR_RETRY_MRC:
380 DEBUG("%s - Reached maximum_retransmit_count (%u > %u), failing status checks",
381 h->ctx.module_name, u->retry.count, u->retry.config->mrc);
382 fail:
383 connection_signal_reconnect(conn, CONNECTION_FAILED);
384 return;
385
386 case FR_RETRY_CONTINUE:
387 if (fr_event_fd_insert(h, NULL, conn->el, h->fd, conn_init_writable, NULL,
388 conn_init_error, conn) < 0) {
389 PERROR("%s - Failed inserting FD event", h->ctx.module_name);
390 connection_signal_reconnect(conn, CONNECTION_FAILED);
391 }
392 return;
393 }
394
395 fr_assert(0);
396}
397
398/** Perform the next step of init and negotiation.
399 *
400 */
401static void conn_init_next(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
402{
403 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
404 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
405
406 if (fr_event_fd_insert(h, NULL, conn->el, h->fd, conn_init_writable, NULL, conn_init_error, conn) < 0) {
407 PERROR("%s - Failed inserting FD event", h->ctx.module_name);
408 connection_signal_reconnect(conn, CONNECTION_FAILED);
409 }
410}
411
412/** Read the connection during the init and negotiation stage.
413 *
414 */
415static void conn_init_readable(fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
416{
417 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
418 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
419 trunk_t *trunk = h->ctx.trunk;
420 rlm_radius_t const *inst = h->ctx.inst;
421 bio_request_t *u = h->status_u;
422 ssize_t slen;
423 fr_pair_list_t reply;
424 uint8_t code = 0;
425
426 fr_pair_list_init(&reply);
427 slen = fr_bio_read(h->bio.read, NULL, h->buffer, h->buflen);
428 if (slen == 0) {
429 /*
430 * @todo - set BIO FD EOF callback, so that we don't have to check it here.
431 */
432 if (h->ctx.fd_info->eof) goto failed;
433 return;
434 }
435
436 /*
437 * We're done reading, return.
438 */
439 if (slen == fr_bio_error(IO_WOULD_BLOCK)) return;
440
441 if (slen < 0) {
442 switch (errno) {
443 case ECONNREFUSED:
444 ERROR("%s - Failed reading response from socket: there is no server listening on outgoing connection %s",
445 h->ctx.module_name, h->ctx.fd_info->name);
446 break;
447
448 default:
449 ERROR("%s - Failed reading response from socket: %s",
450 h->ctx.module_name, fr_syserror(errno));
451 break;
452 }
453
454 failed:
455 connection_signal_reconnect(conn, CONNECTION_FAILED);
456 return;
457 }
458
459 /*
460 * Where we just return in this function, we're letting
461 * the response timer take care of progressing the
462 * connection attempt.
463 */
464 if (slen < RADIUS_HEADER_LENGTH) {
465 ERROR("%s - Packet too short, expected at least %zu bytes got %zd bytes",
466 h->ctx.module_name, (size_t)RADIUS_HEADER_LENGTH, slen);
467 return;
468 }
469
470 if (u->id != h->buffer[1]) {
471 ERROR("%s - Received response with incorrect or expired ID. Expected %u, got %u",
472 h->ctx.module_name, u->id, h->buffer[1]);
473 return;
474 }
475
476 if (!check(h, &slen)) return;
477
478 if (decode(h, &reply, &code,
479 h, h->status_request, h->status_u, u->packet + RADIUS_AUTH_VECTOR_OFFSET,
480 h->buffer, slen) != DECODE_FAIL_NONE) return;
481
482 fr_pair_list_free(&reply); /* FIXME - Do something with these... */
483
484 /*
485 * Process the error, and count this as a success.
486 * This is usually used for dynamic configuration
487 * on startup.
488 */
489 if (code == FR_RADIUS_CODE_PROTOCOL_ERROR) protocol_error_reply(u, h);
490
491 /*
492 * Last trunk event was a failure, be more careful about
493 * bringing up the connection (require multiple responses).
494 */
495 if ((fr_time_gt(trunk->last_failed, fr_time_wrap(0)) && (fr_time_gt(trunk->last_failed, trunk->last_connected))) &&
496 (u->num_replies < inst->num_answers_to_alive)) {
497 /*
498 * Leave the timer in place. This timer is BOTH when we
499 * give up on the current status check, AND when we send
500 * the next status check.
501 */
502 DEBUG("%s - Received %u / %u replies for status check, on connection - %s",
503 h->ctx.module_name, u->num_replies, inst->num_answers_to_alive, h->ctx.fd_info->name);
504 DEBUG("%s - Next status check packet will be in %pVs",
505 h->ctx.module_name, fr_box_time_delta(fr_time_sub(u->retry.next, fr_time())));
506
507 /*
508 * Set the timer for the next retransmit.
509 */
510 if (fr_timer_at(h, el->tl, &u->ev, u->retry.next, false, conn_init_next, conn) < 0) {
511 connection_signal_reconnect(conn, CONNECTION_FAILED);
512 }
513 return;
514 }
515
516 /*
517 * It's alive!
518 */
519 status_check_reset(h, u);
520
521 DEBUG("%s - Connection open - %s", h->ctx.module_name, h->ctx.fd_info->name);
522
523 connection_signal_connected(conn);
524}
525
526/** Send initial negotiation.
527 *
528 */
529static void conn_init_writable(fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
530{
531 connection_t *conn = talloc_get_type_abort(uctx, connection_t);
532 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
533 bio_request_t *u = h->status_u;
534 ssize_t slen;
535
536 if (fr_time_eq(u->retry.start, fr_time_wrap(0))) {
537 u->id = fr_rand() & 0xff; /* We don't care what the value is here */
538 h->status_checking = true; /* Ensure this is valid */
539 fr_retry_init(&u->retry, fr_time(), &h->ctx.inst->retry[u->code]);
540
541 /*
542 * Status checks can never be retransmitted
543 * So increment the ID here.
544 */
545 } else {
546 bio_request_reset(u);
547 u->id++;
548 }
549
550 DEBUG("%s - Sending %s ID %d over connection %s",
551 h->ctx.module_name, fr_radius_packet_name[u->code], u->id, h->ctx.fd_info->name);
552
553 if (encode(h, h->status_request, u, u->id) < 0) {
554 fail:
555 connection_signal_reconnect(conn, CONNECTION_FAILED);
556 return;
557 }
558 DEBUG3("Encoded packet");
559 HEXDUMP3(u->packet, u->packet_len, NULL);
560
561 slen = fr_bio_write(h->bio.write, NULL, u->packet, u->packet_len);
562
563 if (slen == fr_bio_error(IO_WOULD_BLOCK)) goto blocked;
564
565 if (slen < 0) {
566 ERROR("%s - Failed sending %s ID %d length %zu over connection %s: %s",
567 h->ctx.module_name, fr_radius_packet_name[u->code], u->id, u->packet_len, h->ctx.fd_info->name, fr_syserror(errno));
568
569
570 goto fail;
571 }
572
573 /*
574 * @todo - handle partial packets and blocked writes.
575 */
576 if ((size_t)slen < u->packet_len) {
577 blocked:
578 ERROR("%s - Failed sending %s ID %d length %zu over connection %s: writing is blocked",
579 h->ctx.module_name, fr_radius_packet_name[u->code], u->id, u->packet_len, h->ctx.fd_info->name);
580 goto fail;
581 }
582
583 /*
584 * Switch to waiting on read and insert the event
585 * for the response timeout.
586 */
587 if (fr_event_fd_insert(h, NULL, conn->el, h->fd, conn_init_readable, NULL, conn_init_error, conn) < 0) {
588 PERROR("%s - Failed inserting FD event", h->ctx.module_name);
589 goto fail;
590 }
591
592 DEBUG("%s - %s request. Expecting response within %pVs",
593 h->ctx.module_name, (u->retry.count == 1) ? "Originated" : "Retransmitted",
594 fr_box_time_delta(u->retry.rt));
595
596 if (fr_timer_at(h, el->tl, &u->ev, u->retry.next, false, conn_init_timeout, conn) < 0) {
597 PERROR("%s - Failed inserting timer event", h->ctx.module_name);
598 goto fail;
599 }
600
601 /*
602 * Save a copy of the header + Authentication Vector for checking the response.
603 */
604 MEM(u->packet = talloc_memdup(u, u->packet, RADIUS_HEADER_LENGTH));
605}
606
607/** Free a connection handle, closing associated resources
608 *
609 */
610static int _bio_handle_free(bio_handle_t *h)
611{
612 fr_assert(h != NULL);
613
614 fr_assert(h->fd >= 0);
615
616 if (h->status_u) FR_TIMER_DELETE_RETURN(&h->status_u->ev);
617
618 /*
619 * The connection code will take care of deleting the FD from the event loop.
620 */
621
622 DEBUG("%s - Connection closed - %s", h->ctx.module_name, h->ctx.fd_info->name);
623
624 return 0;
625}
626
627static void bio_connected(fr_bio_t *bio)
628{
629 bio_handle_t *h = bio->uctx;
630
631 DEBUG("%s - Connection open - %s", h->ctx.module_name, h->ctx.fd_info->name);
632
633 connection_signal_connected(h->conn);
634}
635
636static void bio_error(fr_bio_t *bio)
637{
638 bio_handle_t *h = bio->uctx;
639
640 DEBUG("%s - Connection failed - %s - %s", h->ctx.module_name, h->ctx.fd_info->name,
641 fr_syserror(h->ctx.fd_info->connect_errno));
642
643 connection_signal_reconnect(h->conn, CONNECTION_FAILED);
644}
645
646static fr_bio_verify_action_t rlm_radius_verify(UNUSED fr_bio_t *bio, void *verify_ctx, UNUSED void *packet_ctx, const void *data, size_t *size)
647{
648 fr_radius_decode_fail_t failure;
649 size_t in_buffer = *size;
650 bio_handle_t *h = verify_ctx;
651 uint8_t const *hdr = data;
652 size_t want;
653
654 if (in_buffer < 20) {
655 *size = RADIUS_HEADER_LENGTH;
656 return FR_BIO_VERIFY_WANT_MORE;
657 }
658
659 /*
660 * Packet is too large, discard it.
661 */
662 want = fr_nbo_to_uint16(hdr + 2);
663 if (want > h->ctx.inst->max_packet_size) {
664 ERROR("%s - Connection %s received too long packet", h->ctx.module_name, h->ctx.fd_info->name);
665 return FR_BIO_VERIFY_ERROR_CLOSE;
666 }
667
668 /*
669 * Not a full packet, we want more data.
670 */
671 if (want < *size) {
672 *size = want;
673 return FR_BIO_VERIFY_WANT_MORE;
674 }
675
676#define REQUIRE_MA(_h) (((_h)->ctx.inst->require_message_authenticator == FR_RADIUS_REQUIRE_MA_YES) || (_h)->ctx.inst->received_message_authenticator)
677
678 /*
679 * See if we need to discard the packet.
680 */
681 if (!fr_radius_ok(data, size, h->ctx.inst->max_attributes, REQUIRE_MA(h), &failure)) {
682 if (failure == DECODE_FAIL_UNKNOWN_PACKET_CODE) return FR_BIO_VERIFY_DISCARD;
683
684 PERROR("%s - Connection %s received bad packet", h->ctx.module_name, h->ctx.fd_info->name);
685
686 return FR_BIO_VERIFY_ERROR_CLOSE;
687 }
688
689 /*
690 * @todo - check if the reply is allowed. Bad replies are discarded later, but it might be worth
691 * checking them here.
692 */
693
694 /*
695 * On input, *size is how much data we have. On output, *size is how much data we want.
696 */
697 return (in_buffer >= *size) ? FR_BIO_VERIFY_OK : FR_BIO_VERIFY_WANT_MORE;
698}
699
700
701/** Initialise a new outbound connection
702 *
703 * @param[out] h_out Where to write the new file descriptor.
704 * @param[in] conn to initialise.
705 * @param[in] uctx A #bio_thread_t
706 */
707CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
708static connection_state_t conn_init(void **h_out, connection_t *conn, void *uctx)
709{
710 int fd;
711 bio_handle_t *h;
712 bio_handle_ctx_t *ctx = uctx; /* thread or home server */
713
714 MEM(h = talloc_zero(conn, bio_handle_t));
715 h->ctx = *ctx;
716 h->conn = conn;
717 h->max_packet_size = h->ctx.inst->max_packet_size;
718 h->last_idle = fr_time();
719
720 MEM(h->buffer = talloc_array(h, uint8_t, h->max_packet_size));
721 h->buflen = h->max_packet_size;
722
723 MEM(h->tt = radius_track_alloc(h));
724
725 h->bio.fd = fr_bio_fd_alloc(h, &h->ctx.fd_config, 0);
726 if (!h->bio.fd) {
727 PERROR("%s - failed opening socket", h->ctx.module_name);
728 fail:
729 talloc_free(h);
730 return CONNECTION_STATE_FAILED;
731 }
732
733 h->bio.fd->uctx = h;
734 h->ctx.fd_info = fr_bio_fd_info(h->bio.fd);
735
736 fd = h->ctx.fd_info->socket.fd;
737 fr_assert(fd >= 0);
738
739 /*
740 * We normally read and write to the FD BIO.
741 */
742 h->bio.read = h->bio.write = h->bio.fd;
743
744 /*
745 * Create a memory BIO for stream sockets. We want to return only complete packets, and not
746 * partial packets.
747 *
748 * @todo - maybe we want to have a fr_bio_verify_t which is independent of fr_bio_mem_t. That
749 * way we don't need a memory BIO for UDP sockets, but we can still add a verification layer for
750 * UDP sockets?
751 */
752 if (h->ctx.fd_config.socket_type == SOCK_STREAM) {
753 h->bio.mem = fr_bio_mem_alloc(h, 8192, 0, h->bio.fd);
754 if (!h->bio.mem) {
755 PERROR("%s - Failed allocating memory buffer - ", h->ctx.module_name);
756 goto fail;
757 }
758
759 if (fr_bio_mem_set_verify(h->bio.mem, rlm_radius_verify, h, false) < 0) {
760 PERROR("%s - Failed setting validation callback - ", h->ctx.module_name);
761 goto fail;
762 }
763
764 /*
765 * For stream sockets, we read into the memory buffer, and then return only one packet at
766 * a time.
767 */
768 h->bio.read = h->bio.mem;
769 h->bio.mem->uctx = h;
770 }
771
772 h->fd = fd;
773
774 talloc_set_destructor(h, _bio_handle_free);
775
776 /*
777 * If the socket isn't connected, then do that first.
778 */
779 if (h->ctx.fd_info->state != FR_BIO_FD_STATE_OPEN) {
780 int rcode;
781
782 fr_assert(h->ctx.fd_info->state == FR_BIO_FD_STATE_CONNECTING);
783
784 /*
785 * We don't pass timeouts here because the trunk has it's own connection timeouts.
786 */
787 rcode = fr_bio_fd_connect_full(h->bio.fd, conn->el, bio_connected, bio_error, NULL, NULL);
788 if (rcode < 0) goto fail;
789
790 *h_out = h;
791
792 if (rcode == 0) return CONNECTION_STATE_CONNECTING;
793
794 fr_assert(rcode == 1);
795 return CONNECTION_STATE_CONNECTED;
796
797 /*
798 * If we're doing status checks, then we want at least
799 * one positive response before signalling that the
800 * connection is open.
801 *
802 * To do this we install special I/O handlers that
803 * only signal the connection as open once we get a
804 * status-check response.
805 */
806 } if (h->ctx.inst->status_check) {
807 status_check_alloc(h);
808
809 /*
810 * Start status checking.
811 *
812 * If we've had no recent failures we need exactly
813 * one response to bring the connection online,
814 * otherwise we need inst->num_answers_to_alive
815 */
816 if (fr_event_fd_insert(h, NULL, conn->el, h->fd, NULL,
817 conn_init_writable, conn_init_error, conn) < 0) goto fail;
818
819 /*
820 * If we're not doing status-checks, signal the connection
821 * as open as soon as it becomes writable.
822 */
823 } else {
824 connection_signal_on_fd(conn, fd);
825 }
826
827 *h_out = h;
828
829 return CONNECTION_STATE_CONNECTING;
830}
831
832/** Shutdown/close a file descriptor
833 *
834 */
835static void conn_close(UNUSED fr_event_list_t *el, void *handle, UNUSED void *uctx)
836{
837 bio_handle_t *h = talloc_get_type_abort(handle, bio_handle_t);
838
839 /*
840 * There's tracking entries still allocated
841 * this is bad, they should have all been
842 * released.
843 */
844 if (h->tt && (h->tt->num_requests != 0)) {
845#ifndef NDEBUG
846 radius_track_state_log(&default_log, L_ERR, __FILE__, __LINE__, h->tt, bio_tracking_entry_log);
847#endif
848 fr_assert_fail("%u tracking entries still allocated at conn close", h->tt->num_requests);
849 }
850
851 DEBUG4("Freeing handle %p", handle);
852
853 talloc_free(h);
854}
855
856/** Connection failed
857 *
858 * @param[in] handle of connection that failed.
859 * @param[in] state the connection was in when it failed.
860 * @param[in] uctx UNUSED.
861 */
862static connection_state_t conn_failed(void *handle, connection_state_t state, UNUSED void *uctx)
863{
864 switch (state) {
865 /*
866 * If the connection was connected when it failed,
867 * we need to handle any outstanding packets and
868 * timer events before reconnecting.
869 */
870 case CONNECTION_STATE_CONNECTED:
871 {
872 bio_handle_t *h = talloc_get_type_abort(handle, bio_handle_t); /* h only available if connected */
873
874 /*
875 * Reset the Status-Server checks.
876 */
877 if (h->status_u) FR_TIMER_DISARM(h->status_u->ev);
878 break;
879
880 default:
881 break;
882 }
883 }
884
885 return CONNECTION_STATE_INIT;
886}
887
888CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
889static connection_t *thread_conn_alloc(trunk_connection_t *tconn, fr_event_list_t *el,
890 connection_conf_t const *conf,
891 char const *log_prefix, void *uctx)
892{
893 connection_t *conn;
894 bio_handle_ctx_t *ctx = uctx; /* thread or home server */
895
896 conn = connection_alloc(tconn, el,
897 &(connection_funcs_t){
898 .init = conn_init,
899 .close = conn_close,
900 .failed = conn_failed
901 },
902 conf,
903 log_prefix,
904 uctx);
905 if (!conn) {
906 PERROR("%s - Failed allocating state handler for new connection", ctx->inst->name);
907 return NULL;
908 }
909 ctx->trunk = tconn->trunk;
910 ctx->module_name = log_prefix;
911
912 return conn;
913}
914
915/** Read and discard data
916 *
917 */
918static void conn_discard(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
919{
920 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
921 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
922 uint8_t buffer[4096];
923 ssize_t slen;
924
925 while ((slen = fr_bio_read(h->bio.read, NULL, buffer, sizeof(buffer))) > 0);
926
927 if (slen < 0) {
928 switch (errno) {
929 case EBADF:
930 case ECONNRESET:
931 case ENOTCONN:
932 case ETIMEDOUT:
933 ERROR("%s - Failed draining socket: %s", h->ctx.module_name, fr_syserror(errno));
934 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
935 break;
936
937 default:
938 break;
939 }
940 }
941}
942
943/** Connection errored
944 *
945 * We were signalled by the event loop that a fatal error occurred on this connection.
946 *
947 * @param[in] el The event list signalling.
948 * @param[in] fd that errored.
949 * @param[in] flags El flags.
950 * @param[in] fd_errno The nature of the error.
951 * @param[in] uctx The trunk connection handle (tconn).
952 */
953static void conn_error(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, void *uctx)
954{
955 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
956 connection_t *conn = tconn->conn;
957 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
958
959 ERROR("%s - Connection %s failed: %s", h->ctx.module_name, h->ctx.fd_info->name, fr_syserror(fd_errno));
960
961 connection_signal_reconnect(conn, CONNECTION_FAILED);
962}
963
964CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
965static void thread_conn_notify(trunk_connection_t *tconn, connection_t *conn,
966 fr_event_list_t *el,
967 trunk_connection_event_t notify_on, UNUSED void *uctx)
968{
969 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
970 fr_event_fd_cb_t read_fn = NULL;
971 fr_event_fd_cb_t write_fn = NULL;
972
973 switch (notify_on) {
974 /*
975 * We may have sent multiple requests to the
976 * other end, so it might be sending us multiple
977 * replies. We want to drain the socket, instead
978 * of letting the packets sit in the UDP receive
979 * queue.
980 */
981 case TRUNK_CONN_EVENT_NONE:
982 read_fn = conn_discard;
983 break;
984
985 case TRUNK_CONN_EVENT_READ:
986 read_fn = trunk_connection_callback_readable;
987 break;
988
989 case TRUNK_CONN_EVENT_WRITE:
990 write_fn = trunk_connection_callback_writable;
991 break;
992
993 case TRUNK_CONN_EVENT_BOTH:
994 read_fn = trunk_connection_callback_readable;
995 write_fn = trunk_connection_callback_writable;
996 break;
997
998 }
999
1000 /*
1001 * Over-ride read for replication.
1002 */
1003 if (h->ctx.inst->mode == RLM_RADIUS_MODE_REPLICATE) {
1004 read_fn = conn_discard;
1005
1006 if (fr_bio_fd_write_only(h->bio.fd) < 0) {
1007 PERROR("%s - Failed setting socket to write-only", h->ctx.module_name);
1008 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1009 return;
1010 }
1011 }
1012
1013 if (fr_event_fd_insert(h, NULL, el, h->fd,
1014 read_fn,
1015 write_fn,
1016 conn_error,
1017 tconn) < 0) {
1018 PERROR("%s - Failed inserting FD event", h->ctx.module_name);
1019
1020 /*
1021 * May free the connection!
1022 */
1023 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1024 }
1025}
1026
1027/*
1028 * Return negative numbers to put 'a' at the top of the heap.
1029 * Return positive numbers to put 'b' at the top of the heap.
1030 *
1031 * We want the value with the lowest timestamp to be prioritized at
1032 * the top of the heap.
1033 */
1034static int8_t request_prioritise(void const *one, void const *two)
1035{
1036 bio_request_t const *a = one;
1037 bio_request_t const *b = two;
1038 int8_t ret;
1039
1040 /*
1041 * Prioritise status check packets
1042 */
1043 ret = (b->status_check - a->status_check);
1044 if (ret != 0) return ret;
1045
1046 /*
1047 * Larger priority is more important.
1048 */
1049 ret = CMP(a->priority, b->priority);
1050 if (ret != 0) return ret;
1051
1052 /*
1053 * Smaller timestamp (i.e. earlier) is more important.
1054 */
1055 return CMP_PREFER_SMALLER(fr_time_unwrap(a->recv_time), fr_time_unwrap(b->recv_time));
1056}
1057
1058/** Decode response packet data, extracting relevant information and validating the packet
1059 *
1060 * @param[in] ctx to allocate pairs in.
1061 * @param[out] reply Pointer to head of pair list to add reply attributes to.
1062 * @param[out] response_code The type of response packet.
1063 * @param[in] h connection handle.
1064 * @param[in] request the request.
1065 * @param[in] u UDP request.
1066 * @param[in] request_authenticator from the original request.
1067 * @param[in] data to decode.
1068 * @param[in] data_len Length of input data.
1069 * @return
1070 * - DECODE_FAIL_NONE on success.
1071 * - DECODE_FAIL_* on failure.
1072 */
1073static fr_radius_decode_fail_t decode(TALLOC_CTX *ctx, fr_pair_list_t *reply, uint8_t *response_code,
1074 bio_handle_t *h, request_t *request, bio_request_t *u,
1075 uint8_t const request_authenticator[static RADIUS_AUTH_VECTOR_LENGTH],
1076 uint8_t *data, size_t data_len)
1077{
1078 rlm_radius_t const *inst = talloc_get_type_abort_const(h->ctx.inst, rlm_radius_t);
1079 uint8_t code;
1080 fr_radius_decode_ctx_t decode_ctx;
1081
1082 *response_code = 0; /* Initialise to keep the rest of the code happy */
1083
1084 RHEXDUMP3(data, data_len, "Read packet");
1085
1086 decode_ctx = (fr_radius_decode_ctx_t) {
1087 .common = &h->ctx.radius_ctx,
1088 .request_code = u->code,
1089 .request_authenticator = request_authenticator,
1090 .tmp_ctx = talloc(ctx, uint8_t),
1091 .end = data + data_len,
1092 .verify = true,
1093 .require_message_authenticator = REQUIRE_MA(h),
1094 };
1095
1096 if (fr_radius_decode(ctx, reply, data, data_len, &decode_ctx) < 0) {
1097 talloc_free(decode_ctx.tmp_ctx);
1098 RPEDEBUG("Failed reading packet");
1099 return DECODE_FAIL_UNKNOWN;
1100 }
1101 talloc_free(decode_ctx.tmp_ctx);
1102
1103 code = data[0];
1104
1105 RDEBUG("Received %s ID %d length %zu reply packet on connection %s",
1106 fr_radius_packet_name[code], data[1], data_len, h->ctx.fd_info->name);
1107 log_request_pair_list(L_DBG_LVL_2, request, NULL, reply, NULL);
1108
1109 /*
1110 * This code is for BlastRADIUS mitigation.
1111 *
1112 * The scenario where this applies is where we send Message-Authenticator
1113 * but the home server doesn't support it or require it, in which case
1114 * the response can be manipulated by an attacker.
1115 */
1116 if ((u->code == FR_RADIUS_CODE_ACCESS_REQUEST) &&
1117 (inst->require_message_authenticator == FR_RADIUS_REQUIRE_MA_AUTO) &&
1118 !*(inst->received_message_authenticator) &&
1119 fr_pair_find_by_da(&request->request_pairs, NULL, attr_message_authenticator) &&
1120 !fr_pair_find_by_da(&request->request_pairs, NULL, attr_eap_message)) {
1121 RINFO("Packet contained a valid Message-Authenticator. Setting \"require_message_authenticator = yes\"");
1122 *(inst->received_message_authenticator) = true;
1123 }
1124
1125 *response_code = code;
1126
1127 /*
1128 * Record the fact we've seen a response
1129 */
1130 u->num_replies++;
1131
1132 /*
1133 * Fixup retry times
1134 */
1135 if (fr_time_gt(u->retry.start, h->mrs_time)) h->mrs_time = u->retry.start;
1136
1137 return DECODE_FAIL_NONE;
1138}
1139
1140static int encode(bio_handle_t *h, request_t *request, bio_request_t *u, uint8_t id)
1141{
1142 ssize_t packet_len;
1143 fr_radius_encode_ctx_t encode_ctx;
1144 rlm_radius_t const *inst = h->ctx.inst;
1145
1146 fr_assert(inst->allowed[u->code]);
1147 fr_assert(!u->packet);
1148
1149 u->packet_len = inst->max_packet_size;
1150 u->packet = h->buffer;
1151
1152 /*
1153 * We should have at minimum 64-byte packets, so don't
1154 * bother doing run-time checks here.
1155 */
1156 fr_assert(u->packet_len >= (size_t) RADIUS_HEADER_LENGTH);
1157
1158 encode_ctx = (fr_radius_encode_ctx_t) {
1159 .common = &h->ctx.radius_ctx,
1160 .rand_ctx = (fr_fast_rand_t) {
1161 .a = fr_rand(),
1162 .b = fr_rand(),
1163 },
1164 .code = u->code,
1165 .id = id,
1166 .add_proxy_state = u->proxied,
1167 };
1168
1169 /*
1170 * If we're sending a status check packet, update any
1171 * necessary timestamps. Also, don't add Proxy-State, as
1172 * we're originating the packet.
1173 */
1174 if (u->status_check) {
1175 fr_pair_t *vp;
1176
1177 vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_event_timestamp);
1178 if (vp) vp->vp_date = fr_time_to_unix_time(u->retry.updated);
1179
1180 encode_ctx.add_proxy_state = false;
1181 }
1182
1183 /*
1184 * Encode it, leaving room for Proxy-State if necessary.
1185 */
1186 packet_len = fr_radius_encode(&FR_DBUFF_TMP(u->packet, u->packet_len),
1187 &request->request_pairs, &encode_ctx);
1188 if (fr_pair_encode_is_error(packet_len)) {
1189 RPERROR("Failed encoding packet");
1190
1191 error:
1192 TALLOC_FREE(u->packet);
1193 return -1;
1194 }
1195
1196 if (packet_len < 0) {
1197 size_t have;
1198 size_t need;
1199
1200 have = u->packet_len;
1201 need = have - packet_len;
1202
1203 if (need > RADIUS_MAX_PACKET_SIZE) {
1204 RERROR("Failed encoding packet. Have %zu bytes of buffer, need %zu bytes",
1205 have, need);
1206 } else {
1207 RERROR("Failed encoding packet. Have %zu bytes of buffer, need %zu bytes. "
1208 "Increase 'max_packet_size'", have, need);
1209 }
1210
1211 goto error;
1212 }
1213 /*
1214 * The encoded packet should NOT over-run the input buffer.
1215 */
1216 fr_assert((size_t) packet_len <= u->packet_len);
1217
1218 /*
1219 * Add Proxy-State to the tail end of the packet.
1220 *
1221 * We need to add it here, and NOT in
1222 * request->request_pairs, because multiple modules
1223 * may be sending the packets at the same time.
1224 */
1225 if (encode_ctx.add_proxy_state) {
1226 fr_pair_t *vp;
1227
1228 MEM(vp = fr_pair_afrom_da(u, attr_proxy_state));
1229 fr_pair_value_memdup(vp, (uint8_t const *) &inst->common_ctx.proxy_state, sizeof(inst->common_ctx.proxy_state), false);
1230 fr_pair_append(&u->extra, vp);
1231 packet_len += 2 + sizeof(inst->common_ctx.proxy_state);
1232 }
1233
1234 /*
1235 * Update our version of the packet length.
1236 */
1237 u->packet_len = packet_len;
1238
1239 /*
1240 * Now that we're done mangling the packet, sign it.
1241 */
1242 if (fr_radius_sign(u->packet, NULL, (uint8_t const *) h->ctx.radius_ctx.secret,
1243 h->ctx.radius_ctx.secret_length) < 0) {
1244 RERROR("Failed signing packet");
1245 goto error;
1246 }
1247
1248 return 0;
1249}
1250
1251
1252/** Revive a connection after "revive_interval"
1253 *
1254 */
1255static void revive_timeout(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
1256{
1257 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
1258 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1259
1260 INFO("%s - Reviving connection %s", h->ctx.module_name, h->ctx.fd_info->name);
1261 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1262}
1263
1264/** Mark a connection dead after "zombie_interval"
1265 *
1266 */
1267static void zombie_timeout(fr_timer_list_t *tl, fr_time_t now, void *uctx)
1268{
1269 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
1270 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1271
1272 INFO("%s - No replies during 'zombie_period', marking connection %s as dead", h->ctx.module_name, h->ctx.fd_info->name);
1273
1274 /*
1275 * Don't use this connection, and re-queue all of its
1276 * requests onto other connections.
1277 */
1278 (void) trunk_connection_requests_requeue(tconn, TRUNK_REQUEST_STATE_ALL, 0, false);
1279
1280 /*
1281 * We do have status checks. Try to reconnect the
1282 * connection immediately. If the status checks pass,
1283 * then the connection will be marked "alive"
1284 */
1285 if (h->ctx.inst->status_check) {
1286 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1287 return;
1288 }
1289
1290 /*
1291 * Revive the connection after a time.
1292 */
1293 if (fr_timer_at(h, tl, &h->zombie_ev,
1294 fr_time_add(now, h->ctx.inst->revive_interval), false,
1295 revive_timeout, tconn) < 0) {
1296 ERROR("Failed inserting revive timeout for connection");
1297 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1298 }
1299}
1300
1301
1302/** See if the connection is zombied.
1303 *
1304 * We check for zombie when major events happen:
1305 *
1306 * 1) request hits its final timeout
1307 * 2) request timer hits, and it needs to be retransmitted
1308 * 3) a DUP packet comes in, and the request needs to be retransmitted
1309 * 4) we're sending a packet.
1310 *
1311 * There MIGHT not be retries configured, so we MUST check for zombie
1312 * when any new packet comes in. Similarly, there MIGHT not be new
1313 * packets, but retries are configured, so we have to check there,
1314 * too.
1315 *
1316 * Also, the socket might not be writable for a while. There MIGHT
1317 * be a long time between getting the timer / DUP signal, and the
1318 * request finally being written to the socket. So we need to check
1319 * for zombie at BOTH the timeout and the mux / write function.
1320 *
1321 * @return
1322 * - true if the connection is zombie.
1323 * - false if the connection is not zombie.
1324 */
1325static bool check_for_zombie(fr_event_list_t *el, trunk_connection_t *tconn, fr_time_t now, fr_time_t last_sent)
1326{
1327 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1328
1329 /*
1330 * We're replicating, and don't care about the health of
1331 * the home server, and this function should not be called.
1332 */
1333 fr_assert(h->ctx.inst->mode != RLM_RADIUS_MODE_REPLICATE);
1334
1335 /*
1336 * If we're status checking OR already zombie, don't go to zombie
1337 */
1338 if (h->status_checking || fr_timer_armed(h->zombie_ev)) return true;
1339
1340 if (fr_time_eq(now, fr_time_wrap(0))) now = fr_time();
1341
1342 /*
1343 * We received a reply since this packet was sent, the connection isn't zombie.
1344 */
1345 if (fr_time_gteq(h->last_reply, last_sent)) return false;
1346
1347 /*
1348 * If we've seen ANY response in the allowed window, then the connection is still alive.
1349 */
1350 if ((h->ctx.inst->mode == RLM_RADIUS_MODE_PROXY) && fr_time_gt(last_sent, fr_time_wrap(0)) &&
1351 (fr_time_lt(fr_time_add(last_sent, h->ctx.inst->response_window), now))) return false;
1352
1353 /*
1354 * Stop using it for new requests.
1355 */
1356 WARN("%s - Entering Zombie state - connection %s", h->ctx.module_name, h->ctx.fd_info->name);
1357 trunk_connection_signal_inactive(tconn);
1358
1359 if (h->ctx.inst->status_check) {
1360 h->status_checking = true;
1361
1362 /*
1363 * Queue up the status check packet. It will be sent
1364 * when the connection is writable.
1365 */
1366 h->status_u->retry.start = fr_time_wrap(0);
1367 h->status_u->treq = NULL;
1368
1369 if (trunk_request_enqueue_on_conn(&h->status_u->treq, tconn, h->status_request,
1370 h->status_u, h->status_u, true) != TRUNK_ENQUEUE_OK) {
1371 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1372 }
1373 } else {
1374 if (fr_timer_at(h, el->tl, &h->zombie_ev, fr_time_add(now, h->ctx.inst->zombie_period),
1375 false, zombie_timeout, tconn) < 0) {
1376 ERROR("Failed inserting zombie timeout for connection");
1377 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1378 }
1379 }
1380
1381 return true;
1382}
1383
1384static void mod_dup(request_t *request, bio_request_t *u)
1385{
1386 bio_handle_t *h;
1387
1388 h = talloc_get_type_abort(u->treq->tconn->conn->h, bio_handle_t);
1389
1390 if (h->ctx.fd_config.socket_type != SOCK_DGRAM) {
1391 RDEBUG("Using stream sockets - suppressing retransmission");
1392 return;
1393 }
1394
1395 /*
1396 * Arguably this should never happen for UDP sockets.
1397 */
1398 if (h->ctx.fd_info->write_blocked) {
1399 RDEBUG("IO is blocked - suppressing retransmission");
1400 return;
1401 }
1402 u->is_retry = true;
1403
1404 /*
1405 * We are doing synchronous proxying, retransmit
1406 * the current request on the same connection.
1407 *
1408 * If it's zombie, we still resend it. If the
1409 * connection is dead, then a callback will move
1410 * this request to a new connection.
1411 */
1412 mod_write(request, u->treq, h);
1413}
1414
1415static void do_retry(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_retry_t const *retry);
1416
1417/** Handle module retries.
1418 *
1419 */
1420static void mod_retry(module_ctx_t const *mctx, request_t *request, fr_retry_t const *retry)
1421{
1422 bio_request_t *u = talloc_get_type_abort(mctx->rctx, bio_request_t);
1423 rlm_radius_t const *inst = talloc_get_type_abort(mctx->mi->data, rlm_radius_t);
1424
1425 do_retry(inst, u, request, retry);
1426}
1427
1428static void do_retry(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_retry_t const *retry)
1429{
1430 trunk_request_t *treq = talloc_get_type_abort(u->treq, trunk_request_t);
1431 trunk_connection_t *tconn = treq->tconn;
1432 fr_time_t now = retry->updated;
1433
1434 fr_assert(request == treq->request);
1435 fr_assert(treq->preq); /* Must still have a protocol request */
1436 fr_assert(treq->preq == u);
1437
1438 switch (retry->state) {
1439 case FR_RETRY_CONTINUE:
1440 u->retry = *retry;
1441
1442 switch (treq->state) {
1443 case TRUNK_REQUEST_STATE_INIT:
1444 case TRUNK_REQUEST_STATE_UNASSIGNED:
1445 fr_assert(0);
1446 break;
1447
1448 case TRUNK_REQUEST_STATE_BACKLOG:
1449 RDEBUG("Packet is still in the backlog queue to be sent - suppressing retransmission");
1450 return;
1451
1452 case TRUNK_REQUEST_STATE_PENDING:
1453 RDEBUG("Packet is still in the pending queue to be sent - suppressing retransmission");
1454 return;
1455
1456 case TRUNK_REQUEST_STATE_PARTIAL:
1457 RDEBUG("Packet was partially written, as IO is blocked - suppressing retransmission");
1458 return;
1459
1460 case TRUNK_REQUEST_STATE_SENT:
1461 fr_assert(tconn);
1462
1463 mod_dup(request, u);
1464 return;
1465
1466 case TRUNK_REQUEST_STATE_REAPABLE:
1467 case TRUNK_REQUEST_STATE_COMPLETE:
1468 case TRUNK_REQUEST_STATE_FAILED:
1469 case TRUNK_REQUEST_STATE_CANCEL:
1470 case TRUNK_REQUEST_STATE_CANCEL_SENT:
1471 case TRUNK_REQUEST_STATE_CANCEL_PARTIAL:
1472 case TRUNK_REQUEST_STATE_CANCEL_COMPLETE:
1473 fr_assert(0);
1474 break;
1475 }
1476 break;
1477
1478 case FR_RETRY_MRD:
1479 REDEBUG("Reached maximum_retransmit_duration (%pVs > %pVs), failing request",
1480 fr_box_time_delta(fr_time_sub(now, retry->start)), fr_box_time_delta(retry->config->mrd));
1481 break;
1482
1483 case FR_RETRY_MRC:
1484 REDEBUG("Reached maximum_retransmit_count (%u > %u), failing request",
1485 retry->count, retry->config->mrc);
1486 break;
1487 }
1488
1489 u->rcode = RLM_MODULE_FAIL;
1490 trunk_request_signal_fail(treq);
1491
1492 /*
1493 * We don't do zombie stuff!
1494 */
1495 if (!tconn || (inst->mode == RLM_RADIUS_MODE_REPLICATE)) return;
1496
1497 check_for_zombie(unlang_interpret_event_list(request), tconn, now, retry->start);
1498}
1499
1500CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
1501static void request_mux(UNUSED fr_event_list_t *el,
1502 trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
1503{
1504 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
1505 trunk_request_t *treq;
1506 request_t *request;
1507
1508 if (unlikely(trunk_connection_pop_request(&treq, tconn) < 0)) return;
1509
1510 /*
1511 * No more requests to send
1512 */
1513 if (!treq) return;
1514
1515 request = treq->request;
1516
1517 mod_write(request, treq, h);
1518}
1519
1520static void mod_write(request_t *request, trunk_request_t *treq, bio_handle_t *h)
1521{
1522 rlm_radius_t const *inst = h->ctx.inst;
1523 bio_request_t *u;
1524 char const *action;
1525 uint8_t const *packet;
1526 size_t packet_len;
1527 ssize_t slen;
1528
1529 fr_assert((treq->state == TRUNK_REQUEST_STATE_PENDING) ||
1530 (treq->state == TRUNK_REQUEST_STATE_PARTIAL));
1531
1532 u = treq->preq;
1533
1534 fr_assert(!u->status_check);
1535
1536 /*
1537 * If it's a partial packet, then write the partial bit.
1538 */
1539 if (u->partial) {
1540 fr_assert(u->partial < u->packet_len);
1541 packet = u->packet + u->partial;
1542 packet_len = u->packet_len - u->partial;
1543 goto do_write;
1544 }
1545
1546 /*
1547 * No previous packet, OR can't retransmit the
1548 * existing one. Oh well.
1549 *
1550 * Note that if we can't retransmit the previous
1551 * packet, then u->rr MUST already have been
1552 * deleted in the request_cancel() function
1553 * or request_release_conn() function when
1554 * the REQUEUE signal was received.
1555 */
1556 if (!u->packet) {
1557 fr_assert(!u->rr);
1558
1559 if (unlikely(radius_track_entry_reserve(&u->rr, treq, h->tt, request, u->code, treq) < 0)) {
1560#ifndef NDEBUG
1561 radius_track_state_log(&default_log, L_ERR, __FILE__, __LINE__,
1562 h->tt, bio_tracking_entry_log);
1563#endif
1564 fr_assert_fail("Tracking entry allocation failed: %s", fr_strerror());
1565 trunk_request_signal_fail(treq);
1566 return;
1567 }
1568 fr_assert(u->rr);
1569 u->id = u->rr->id;
1570
1571 RDEBUG("Sending %s ID %d length %zu over connection %s",
1572 fr_radius_packet_name[u->code], u->id, u->packet_len, h->ctx.fd_info->name);
1573
1574 if (encode(h, request, u, u->id) < 0) {
1575 /*
1576 * Need to do this because request_conn_release
1577 * may not be called.
1578 */
1579 bio_request_reset(u);
1580 trunk_request_signal_fail(treq);
1581 return;
1582 }
1583 RHEXDUMP3(u->packet, u->packet_len, "Encoded packet");
1584
1585 /*
1586 * Remember the authentication vector, which now has the
1587 * packet signature.
1588 */
1589 (void) radius_track_entry_update(u->rr, u->packet + RADIUS_AUTH_VECTOR_OFFSET);
1590 } else {
1591 RDEBUG("Retransmitting %s ID %d length %zu over connection %s",
1592 fr_radius_packet_name[u->code], u->id, u->packet_len, h->ctx.fd_info->name);
1593 }
1594
1595 /*
1596 * @todo - When logging Message-Authenticator, don't print its' value.
1597 */
1598 log_request_pair_list(L_DBG_LVL_2, request, NULL, &request->request_pairs, NULL);
1599 if (!fr_pair_list_empty(&u->extra)) log_request_pair_list(L_DBG_LVL_2, request, NULL, &u->extra, NULL);
1600
1601 packet = u->packet;
1602 packet_len = u->packet_len;
1603
1604do_write:
1605 slen = fr_bio_write(h->bio.write, NULL, packet, packet_len);
1606
1607 /*
1608 * Can't write anything, requeue it on a different socket.
1609 */
1610 if (slen == fr_bio_error(IO_WOULD_BLOCK)) goto requeue;
1611
1612 if (slen < 0) {
1613 switch (errno) {
1614 /*
1615 * There is an error in the request.
1616 */
1617 case EMSGSIZE: /* Packet size exceeds max size allowed on socket */
1618 ERROR("%s - Failed sending data over connection %s: %s",
1619 h->ctx.module_name, h->ctx.fd_info->name, fr_syserror(errno));
1620 trunk_request_signal_fail(treq);
1621 break;
1622
1623 /*
1624 * There is an error in the connection. The reconnection will re-queue any pending or
1625 * sent requests, so we don't have to do any cleanup.
1626 */
1627 default:
1628 ERROR("%s - Failed sending data over connection %s: %s",
1629 h->ctx.module_name, h->ctx.fd_info->name, fr_syserror(errno));
1630 trunk_connection_signal_reconnect(treq->tconn, CONNECTION_FAILED);
1631 break;
1632 }
1633
1634 return;
1635 }
1636
1637 /*
1638 * No data to send, ignore the write for partials, but otherwise requeue it.
1639 */
1640 if (slen == 0) {
1641 if (u->partial) return;
1642
1643 requeue:
1644 RWARN("%s - Failed sending data over connection %s: sent zero bytes",
1645 h->ctx.module_name, h->ctx.fd_info->name);
1646 trunk_request_requeue(treq);
1647 return;
1648 }
1649
1650 packet_len += slen;
1651 if (packet_len < u->packet_len) {
1652 /*
1653 * The first time around, save a copy of the packet for later writing.
1654 */
1655 if (!u->partial) MEM(u->packet = talloc_memdup(u, u->packet, u->packet_len));
1656
1657 u->partial = packet_len;
1658 trunk_request_signal_partial(treq);
1659 return;
1660 }
1661
1662 /*
1663 * For retransmissions.
1664 */
1665 u->partial = 0;
1666
1667 /*
1668 * Don't print anything extra for replication.
1669 */
1670 if (inst->mode == RLM_RADIUS_MODE_REPLICATE) {
1671 u->rcode = RLM_MODULE_OK;
1672 trunk_request_signal_complete(treq);
1673 return;
1674 }
1675
1676 /*
1677 * On first packet, signal it as sent, and update stats.
1678 *
1679 * Later packets are just retransmissions to the BIO, and don't need to involve
1680 * the trunk code.
1681 */
1682 if (u->retry.count == 1) {
1683 h->last_sent = u->retry.start;
1684 if (fr_time_lteq(h->first_sent, h->last_idle)) h->first_sent = h->last_sent;
1685
1686 trunk_request_signal_sent(treq);
1687
1688 action = u->proxied ? "Proxied" : "Originated";
1689
1690 } else {
1691 /*
1692 * We don't signal the trunk that it's been sent, it was already senty
1693 */
1694 action = "Retransmitted";
1695 }
1696
1697 fr_assert(!u->status_check);
1698
1699 if (!u->proxied) {
1700 RDEBUG("%s request. Expecting response within %pVs", action,
1701 fr_box_time_delta(u->retry.rt));
1702
1703 } else {
1704 /*
1705 * If the packet doesn't get a response,
1706 * then bio_request_free() will notice, and run conn_zombie()
1707 */
1708 RDEBUG("%s request. Relying on NAS to perform more retransmissions", action);
1709 }
1710
1711 /*
1712 * We don't retransmit over TCP.
1713 */
1714 if (h->ctx.fd_config.socket_type != SOCK_DGRAM) return;
1715
1716 /*
1717 * If we only send one datagram packet, then don't bother saving it.
1718 */
1719 if (u->retry.config && u->retry.config->mrc == 1) {
1720 u->packet = NULL;
1721 return;
1722 }
1723
1724 MEM(u->packet = talloc_memdup(u, u->packet, u->packet_len));
1725}
1726
1727/** Deal with Protocol-Error replies, and possible negotiation
1728 *
1729 */
1730static void protocol_error_reply(bio_request_t *u, bio_handle_t *h)
1731{
1732 bool error_601 = false;
1733 uint32_t response_length = 0;
1734 uint8_t const *attr, *end;
1735
1736 end = h->buffer + fr_nbo_to_uint16(h->buffer + 2);
1737
1738 for (attr = h->buffer + RADIUS_HEADER_LENGTH;
1739 attr < end;
1740 attr += attr[1]) {
1741 /*
1742 * Error-Cause = Response-Too-Big
1743 */
1744 if ((attr[0] == attr_error_cause->attr) && (attr[1] == 6)) {
1745 uint32_t error;
1746
1747 memcpy(&error, attr + 2, 4);
1748 error = ntohl(error);
1749 if (error == 601) error_601 = true;
1750 continue;
1751 }
1752
1753 /*
1754 * The other end wants us to increase our Response-Length
1755 */
1756 if ((attr[0] == attr_response_length->attr) && (attr[1] == 6)) {
1757 memcpy(&response_length, attr + 2, 4);
1758 continue;
1759 }
1760
1761 /*
1762 * Protocol-Error packets MUST contain an
1763 * Original-Packet-Code attribute.
1764 *
1765 * The attribute containing the
1766 * Original-Packet-Code is an extended
1767 * attribute.
1768 */
1769 if (attr[0] != attr_extended_attribute_1->attr) continue;
1770
1771 /*
1772 * ATTR + LEN + EXT-Attr + uint32
1773 */
1774 if (attr[1] != 7) continue;
1775
1776 /*
1777 * See if there's an Original-Packet-Code.
1778 */
1779 if (attr[2] != (uint8_t)attr_original_packet_code->attr) continue;
1780
1781 /*
1782 * Has to be an 8-bit number.
1783 */
1784 if ((attr[3] != 0) ||
1785 (attr[4] != 0) ||
1786 (attr[5] != 0)) {
1787 u->rcode = RLM_MODULE_FAIL;
1788 return;
1789 }
1790
1791 /*
1792 * The value has to match. We don't
1793 * currently multiplex different codes
1794 * with the same IDs on connections. So
1795 * this check is just for RFC compliance,
1796 * and for sanity.
1797 */
1798 if (attr[6] != u->code) {
1799 u->rcode = RLM_MODULE_FAIL;
1800 return;
1801 }
1802 }
1803
1804 /*
1805 * Error-Cause = Response-Too-Big
1806 *
1807 * The other end says it needs more room to send it's response
1808 *
1809 * Limit it to reasonable values.
1810 */
1811 if (error_601 && response_length && (response_length > h->buflen)) {
1812 if (response_length < 4096) response_length = 4096;
1813 if (response_length > 65535) response_length = 65535;
1814
1815 DEBUG("%s - Increasing buffer size to %u for connection %s", h->ctx.module_name, response_length, h->ctx.fd_info->name);
1816
1817 /*
1818 * Make sure to copy the packet over!
1819 */
1820 attr = h->buffer;
1821 h->buflen = response_length;
1822 MEM(h->buffer = talloc_array(h, uint8_t, h->buflen));
1823
1824 memcpy(h->buffer, attr, end - attr);
1825 }
1826
1827 /*
1828 * fail - something went wrong internally, or with the connection.
1829 * invalid - wrong response to packet
1830 * handled - best remaining alternative :(
1831 *
1832 * i.e. if the response is NOT accept, reject, whatever,
1833 * then we shouldn't allow the caller to do any more
1834 * processing of this packet. There was a protocol
1835 * error, and the response is valid, but not useful for
1836 * anything.
1837 */
1838 u->rcode = RLM_MODULE_HANDLED;
1839}
1840
1841
1842/** Handle retries for a status check
1843 *
1844 */
1845static void status_check_next(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
1846{
1847 trunk_connection_t *tconn = talloc_get_type_abort(uctx, trunk_connection_t);
1848 bio_handle_t *h = talloc_get_type_abort(tconn->conn->h, bio_handle_t);
1849
1850 if (trunk_request_enqueue_on_conn(&h->status_u->treq, tconn, h->status_request,
1851 h->status_u, h->status_u, true) != TRUNK_ENQUEUE_OK) {
1852 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1853 }
1854}
1855
1856
1857/** Deal with replies replies to status checks and possible negotiation
1858 *
1859 */
1860static void status_check_reply(trunk_request_t *treq, fr_time_t now)
1861{
1862 bio_handle_t *h = talloc_get_type_abort(treq->tconn->conn->h, bio_handle_t);
1863 rlm_radius_t const *inst = h->ctx.inst;
1864 bio_request_t *u = talloc_get_type_abort(treq->rctx, bio_request_t);
1865
1866 fr_assert(treq->preq == h->status_u);
1867 fr_assert(treq->rctx == h->status_u);
1868
1869 u->treq = NULL;
1870
1871 /*
1872 * @todo - do other negotiation and signaling.
1873 */
1874 if (h->buffer[0] == FR_RADIUS_CODE_PROTOCOL_ERROR) protocol_error_reply(u, h);
1875
1876 if (u->num_replies < inst->num_answers_to_alive) {
1877 DEBUG("Received %u / %u replies for status check, on connection - %s",
1878 u->num_replies, inst->num_answers_to_alive, h->ctx.fd_info->name);
1879 DEBUG("Next status check packet will be in %pVs", fr_box_time_delta(fr_time_sub(u->retry.next, now)));
1880
1881 /*
1882 * Set the timer for the next retransmit.
1883 */
1884 if (fr_timer_at(h, h->ctx.el->tl, &u->ev, u->retry.next, false, status_check_next, treq->tconn) < 0) {
1885 trunk_connection_signal_reconnect(treq->tconn, CONNECTION_FAILED);
1886 }
1887 return;
1888 }
1889
1890 DEBUG("Received enough replies to status check, marking connection as active - %s", h->ctx.fd_info->name);
1891
1892 /*
1893 * Set the "last idle" time to now, so that we don't
1894 * restart zombie_period until sufficient time has
1895 * passed.
1896 */
1897 h->last_idle = fr_time();
1898
1899 /*
1900 * Reset retry interval and retransmission counters
1901 * also frees u->ev.
1902 */
1903 status_check_reset(h, u);
1904 trunk_connection_signal_active(treq->tconn);
1905}
1906
1907CC_NO_UBSAN(function) /* UBSAN: false positive - public vs private connection_t trips --fsanitize=function*/
1908static void request_demux(UNUSED fr_event_list_t *el, trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
1909{
1910 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
1911
1912 DEBUG3("%s - Reading data for connection %s", h->ctx.module_name, h->ctx.fd_info->name);
1913
1914 while (true) {
1915 ssize_t slen;
1916
1917 trunk_request_t *treq;
1918 request_t *request;
1919 bio_request_t *u;
1920 radius_track_entry_t *rr;
1921 fr_radius_decode_fail_t reason;
1922 uint8_t code = 0;
1923 fr_pair_list_t reply;
1924 fr_pair_t *vp;
1925
1926 fr_time_t now;
1927
1928 fr_pair_list_init(&reply);
1929
1930 /*
1931 * Drain the socket of all packets. If we're busy, this
1932 * saves a round through the event loop. If we're not
1933 * busy, a few extra system calls don't matter.
1934 */
1935 slen = fr_bio_read(h->bio.read, NULL, h->buffer, h->buflen);
1936 if (slen == 0) {
1937 /*
1938 * @todo - set BIO FD EOF callback, so that we don't have to check it here.
1939 */
1940 if (h->ctx.fd_info->eof) trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1941 return;
1942 }
1943
1944 /*
1945 * We're done reading, return.
1946 */
1947 if (slen == fr_bio_error(IO_WOULD_BLOCK)) return;
1948
1949 if (slen < 0) {
1950 ERROR("%s - Failed reading response from socket: %s",
1951 h->ctx.module_name, fr_syserror(errno));
1952 trunk_connection_signal_reconnect(tconn, CONNECTION_FAILED);
1953 return;
1954 }
1955
1956 if (slen < RADIUS_HEADER_LENGTH) {
1957 ERROR("%s - Packet too short, expected at least %zu bytes got %zd bytes",
1958 h->ctx.module_name, (size_t)RADIUS_HEADER_LENGTH, slen);
1959 continue;
1960 }
1961
1962 /*
1963 * Note that we don't care about packet codes. All
1964 * packet codes share the same ID space.
1965 */
1966 rr = radius_track_entry_find(h->tt, h->buffer[1], NULL);
1967 if (!rr) {
1968 WARN("%s - Ignoring reply with ID %i that arrived too late",
1969 h->ctx.module_name, h->buffer[1]);
1970 continue;
1971 }
1972
1973 treq = talloc_get_type_abort(rr->uctx, trunk_request_t);
1974 request = treq->request;
1975 fr_assert(request != NULL);
1976 u = talloc_get_type_abort(treq->rctx, bio_request_t);
1977 fr_assert(u == treq->preq);
1978
1979 /*
1980 * Validate and decode the incoming packet
1981 */
1982
1983 if (!check(h, &slen)) {
1984 RWARN("Ignoring malformed packet");
1985 continue;
1986 }
1987
1988 reason = decode(request->reply_ctx, &reply, &code, h, request, u, rr->vector, h->buffer, (size_t)slen);
1989 if (reason != DECODE_FAIL_NONE) continue;
1990
1991 /*
1992 * Only valid packets are processed
1993 * Otherwise an attacker could perform
1994 * a DoS attack against the proxying servers
1995 * by sending fake responses for upstream
1996 * servers.
1997 */
1998 h->last_reply = now = fr_time();
1999
2000 /*
2001 * Status-Server can have any reply code, we don't care
2002 * what it is. So long as it's signed properly, we
2003 * accept it. This flexibility is because we don't
2004 * expose Status-Server to the admins. It's only used by
2005 * this module for internal signalling.
2006 */
2007 if (u == h->status_u) {
2008 fr_pair_list_free(&reply); /* Probably want to pass this to status_check_reply? */
2009 status_check_reply(treq, now);
2010 trunk_request_signal_complete(treq);
2011 continue;
2012 }
2013
2014 /*
2015 * Handle any state changes, etc. needed by receiving a
2016 * Protocol-Error reply packet.
2017 *
2018 * Protocol-Error is permitted as a reply to any
2019 * packet.
2020 */
2021 switch (code) {
2022 case FR_RADIUS_CODE_PROTOCOL_ERROR:
2023 protocol_error_reply(u, h);
2024 break;
2025
2026 default:
2027 break;
2028 }
2029
2030 /*
2031 * Mark up the request as being an Access-Challenge, if
2032 * required.
2033 *
2034 * We don't do this for other packet types, because the
2035 * ok/fail nature of the module return code will
2036 * automatically result in it the parent request
2037 * returning an ok/fail packet code.
2038 */
2039 if ((u->code == FR_RADIUS_CODE_ACCESS_REQUEST) && (code == FR_RADIUS_CODE_ACCESS_CHALLENGE)) {
2040 vp = fr_pair_find_by_da(&request->reply_pairs, NULL, attr_packet_type);
2041 if (!vp) {
2042 MEM(vp = fr_pair_afrom_da(request->reply_ctx, attr_packet_type));
2043 vp->vp_uint32 = FR_RADIUS_CODE_ACCESS_CHALLENGE;
2044 fr_pair_append(&request->reply_pairs, vp);
2045 }
2046 }
2047
2048 /*
2049 * Delete Proxy-State attributes from the reply.
2050 */
2051 fr_pair_delete_by_da(&reply, attr_proxy_state);
2052
2053 /*
2054 * If the reply has Message-Authenticator, then over-ride its value with all zeros, so
2055 * that we don't confuse anyone reading the debug output.
2056 */
2057 if ((vp = fr_pair_find_by_da(&reply, NULL, attr_message_authenticator)) != NULL) {
2058 (void) fr_pair_value_memdup(vp, (uint8_t const *) "", 1, false);
2059 }
2060
2061 treq->request->reply->code = code;
2062 u->rcode = radius_code_to_rcode[code];
2063 fr_pair_list_append(&request->reply_pairs, &reply);
2064 trunk_request_signal_complete(treq);
2065 }
2066}
2067
2068/** Remove the request from any tracking structures
2069 *
2070 * Frees encoded packets if the request is being moved to a new connection
2071 */
2072static void request_cancel(UNUSED connection_t *conn, void *preq_to_reset,
2073 trunk_cancel_reason_t reason, UNUSED void *uctx)
2074{
2075 bio_request_t *u = preq_to_reset;
2076
2077 /*
2078 * Request has been requeued on the same
2079 * connection due to timeout or DUP signal. We
2080 * keep the same packet to avoid re-encoding it.
2081 */
2082 if (reason == TRUNK_CANCEL_REASON_REQUEUE) {
2083 /*
2084 * Delete the request_timeout
2085 *
2086 * Note: There might not be a request timeout
2087 * set in the case where the request was
2088 * queued for sendmmsg but never actually
2089 * sent.
2090 */
2091 FR_TIMER_DISARM(u->ev);
2092 }
2093
2094 /*
2095 * Other cancellations are dealt with by
2096 * request_conn_release as the request is removed
2097 * from the trunk.
2098 */
2099}
2100
2101/** Clear out anything associated with the handle from the request
2102 *
2103 */
2104static void request_conn_release(connection_t *conn, void *preq_to_reset, UNUSED void *uctx)
2105{
2106 bio_request_t *u = preq_to_reset;
2107 bio_handle_t *h = talloc_get_type_abort(conn->h, bio_handle_t);
2108
2109 FR_TIMER_DISARM(u->ev);
2110 bio_request_reset(u);
2111
2112 if (h->ctx.inst->mode == RLM_RADIUS_MODE_REPLICATE) return;
2113
2114 u->num_replies = 0;
2115
2116 /*
2117 * If there are no outstanding tracking entries
2118 * allocated then the connection is "idle".
2119 */
2120 if (!h->tt || (h->tt->num_requests == 0)) h->last_idle = fr_time();
2121}
2122
2123/** Write out a canned failure
2124 *
2125 */
2126static void request_fail(request_t *request, NDEBUG_UNUSED void *preq, void *rctx,
2127 NDEBUG_UNUSED trunk_request_state_t state, UNUSED void *uctx)
2128{
2129 bio_request_t *u = talloc_get_type_abort(rctx, bio_request_t);
2130
2131 fr_assert(u == preq);
2132
2133 fr_assert(!u->rr && !u->packet && fr_pair_list_empty(&u->extra) && !u->ev); /* Dealt with by request_conn_release */
2134
2135 fr_assert(state != TRUNK_REQUEST_STATE_INIT);
2136
2137 if (u->status_check) return;
2138
2139 u->rcode = RLM_MODULE_FAIL;
2140 u->treq = NULL;
2141
2142 unlang_interpret_mark_runnable(request);
2143}
2144
2145/** Response has already been written to the rctx at this point
2146 *
2147 */
2148static void request_complete(request_t *request, NDEBUG_UNUSED void *preq, void *rctx, UNUSED void *uctx)
2149{
2150 bio_request_t *u = talloc_get_type_abort(rctx, bio_request_t);
2151
2152 fr_assert(u == preq);
2153
2154 fr_assert(!u->rr && !u->packet && fr_pair_list_empty(&u->extra) && !u->ev); /* Dealt with by request_conn_release */
2155
2156 if (u->status_check) return;
2157
2158 u->treq = NULL;
2159
2160 unlang_interpret_mark_runnable(request);
2161}
2162
2163/** Resume execution of the request, returning the rcode set during trunk execution
2164 *
2165 */
2166static unlang_action_t mod_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, UNUSED request_t *request)
2167{
2168 bio_request_t *u = talloc_get_type_abort(mctx->rctx, bio_request_t);
2169 rlm_rcode_t rcode = u->rcode;
2170
2171 talloc_free(u);
2172
2173 RETURN_MODULE_RCODE(rcode);
2174}
2175
2176static void do_signal(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_signal_t action);
2177
2178static void mod_signal(module_ctx_t const *mctx, UNUSED request_t *request, fr_signal_t action)
2179{
2180 rlm_radius_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_radius_t);
2181
2182 bio_request_t *u = talloc_get_type_abort(mctx->rctx, bio_request_t);
2183
2184 do_signal(inst, u, request, action);
2185}
2186
2187static void do_signal(rlm_radius_t const *inst, bio_request_t *u, UNUSED request_t *request, fr_signal_t action)
2188{
2189 /*
2190 * We received a duplicate packet, but we're not doing
2191 * synchronous proxying. Ignore the dup, and rely on the
2192 * IO submodule to time it's own retransmissions.
2193 */
2194 if ((action == FR_SIGNAL_DUP) && (inst->mode != RLM_RADIUS_MODE_PROXY)) return;
2195
2196 /*
2197 * If we don't have a treq associated with the
2198 * rctx it's likely because the request was
2199 * scheduled, but hasn't yet been resumed, and
2200 * has received a signal, OR has been resumed
2201 * and immediately cancelled as the event loop
2202 * is exiting, in which case
2203 * unlang_request_is_scheduled will return false
2204 * (don't use it).
2205 */
2206 if (!u->treq) return;
2207
2208 switch (action) {
2209 /*
2210 * The request is being cancelled, tell the
2211 * trunk so it can clean up the treq.
2212 */
2213 case FR_SIGNAL_CANCEL:
2214 trunk_request_signal_cancel(u->treq);
2215 u->treq = NULL;
2216 return;
2217
2218 /*
2219 * Requeue the request on the same connection
2220 * causing a "retransmission" if the request
2221 * has already been sent out.
2222 */
2223 case FR_SIGNAL_DUP:
2224 mod_dup(request, u);
2225 return;
2226
2227 default:
2228 return;
2229 }
2230}
2231
2232/** Free a bio_request_t
2233 *
2234 * Allows us to set break points for debugging.
2235 */
2236static int _bio_request_free(bio_request_t *u)
2237{
2238 if (!u->treq) return 0;
2239
2240#ifndef NDEBUG
2241 {
2242 trunk_request_t *treq;
2243 treq = talloc_get_type_abort(u->treq, trunk_request_t);
2244 fr_assert(treq->preq == u);
2245 }
2246#endif
2247
2248 fr_assert_msg(!fr_timer_armed(u->ev), "bio_request_t freed with active timer");
2249
2250 FR_TIMER_DELETE_RETURN(&u->ev);
2251
2252 fr_assert(u->rr == NULL);
2253
2254 return 0;
2255}
2256
2257static int mod_enqueue(bio_request_t **p_u, fr_retry_config_t const **p_retry_config,
2258 rlm_radius_t const *inst, trunk_t *trunk, request_t *request)
2259{
2260 bio_request_t *u;
2261 trunk_request_t *treq;
2262 fr_retry_config_t const *retry_config;
2263
2264 fr_assert(request->packet->code > 0);
2265 fr_assert(request->packet->code < FR_RADIUS_CODE_MAX);
2266
2267 /*
2268 * Do any necessary RADIUS level fixups
2269 * - check Proxy-State
2270 * - do CHAP-Challenge fixups
2271 */
2272 if (radius_fixups(inst, request) < 0) return 0;
2273
2274 treq = trunk_request_alloc(trunk, request);
2275 if (!treq) {
2276 REDEBUG("Failed allocating handler for request");
2277 return -1;
2278 }
2279
2280 MEM(u = talloc_zero(request, bio_request_t));
2281 talloc_set_destructor(u, _bio_request_free);
2282
2283 /*
2284 * Can't use compound literal - const issues.
2285 */
2286 u->code = request->packet->code;
2287 u->priority = request->async->priority;
2288 u->recv_time = request->async->recv_time;
2289 fr_pair_list_init(&u->extra);
2290
2291 u->retry.count = 1;
2292
2293 u->rcode = RLM_MODULE_FAIL;
2294
2295 switch(trunk_request_enqueue(&treq, trunk, request, u, u)) {
2296 case TRUNK_ENQUEUE_OK:
2297 case TRUNK_ENQUEUE_IN_BACKLOG:
2298 break;
2299
2300 case TRUNK_ENQUEUE_NO_CAPACITY:
2301 REDEBUG("Unable to queue packet - connections at maximum capacity");
2302 fail:
2303 fr_assert(!u->rr && !u->packet); /* Should not have been fed to the muxer */
2304 trunk_request_free(&treq); /* Return to the free list */
2305 talloc_free(u);
2306 return -1;
2307
2308 case TRUNK_ENQUEUE_DST_UNAVAILABLE:
2309 REDEBUG("All destinations are down - cannot send packet");
2310 goto fail;
2311
2312 case TRUNK_ENQUEUE_FAIL:
2313 REDEBUG("Unable to queue packet");
2314 goto fail;
2315 }
2316
2317 u->treq = treq; /* Remember for signalling purposes */
2318 fr_assert(treq->rctx == u);
2319
2320 /*
2321 * Figure out if we're originating the packet or proxying it. And also figure out if we have to
2322 * retry.
2323 */
2324 switch (inst->mode) {
2325 case RLM_RADIUS_MODE_INVALID:
2326 case RLM_RADIUS_MODE_UNCONNECTED_REPLICATE: /* unconnected sockets are UDP, and bypass the trunk */
2327 REDEBUG("Internal sanity check failed - connection trunking cannot be used for replication");
2328 return -1;
2329
2330 /*
2331 * We originate this packet if it was taken from the detail module, which doesn't have a
2332 * real client. @todo - do a better check here.
2333 *
2334 * We originate this packet if the parent request is not compatible with this one
2335 * (i.e. it's from a different protocol).
2336 *
2337 * We originate the packet if the parent is from the same dictionary, but has a different
2338 * packet code. This lets us receive Accounting-Request, and originate
2339 * Disconnect-Request.
2340 */
2341 case RLM_RADIUS_MODE_XLAT_PROXY:
2342 case RLM_RADIUS_MODE_PROXY:
2343 if (!request->parent) {
2344 u->proxied = (request->client && request->client->cs != NULL);
2345
2346 } else if (!fr_dict_compatible(request->parent->proto_dict, request->proto_dict)) {
2347 u->proxied = false;
2348
2349 } else {
2350 u->proxied = (request->parent->packet->code == request->packet->code);
2351 }
2352
2353 /*
2354 * Proxied packets get a final timeout, as we retry only on DUP packets.
2355 */
2356 if (u->proxied) goto timeout_retry;
2357
2358 FALL_THROUGH;
2359
2360 /*
2361 * Client packets (i.e. packets we originate) get retries for UDP. And no retries for TCP.
2362 */
2363 case RLM_RADIUS_MODE_CLIENT:
2364 if (inst->fd_config.socket_type == SOCK_DGRAM) {
2365 retry_config = &inst->retry[u->code];
2366 break;
2367 }
2368 FALL_THROUGH;
2369
2370 /*
2371 * Replicated packets are never retried, but they have a timeout if the socket isn't
2372 * ready for writing.
2373 */
2374 case RLM_RADIUS_MODE_REPLICATE:
2375 timeout_retry:
2376 retry_config = &inst->timeout_retry;
2377 break;
2378 }
2379
2380 /*
2381 * The event loop will take care of demux && sending the
2382 * packet, along with any retransmissions.
2383 */
2384 *p_u = u;
2385 *p_retry_config = retry_config;
2386
2387 return 1;
2388}
2389
2390static void home_server_free(void *data)
2391{
2392 home_server_t *home = data;
2393
2394 talloc_free(home);
2395}
2396
2397static const trunk_io_funcs_t io_funcs = {
2398 .connection_alloc = thread_conn_alloc,
2399 .connection_notify = thread_conn_notify,
2400 .request_prioritise = request_prioritise,
2401 .request_mux = request_mux,
2402 .request_demux = request_demux,
2403 .request_conn_release = request_conn_release,
2404 .request_complete = request_complete,
2405 .request_fail = request_fail,
2406 .request_cancel = request_cancel,
2407};
2408
2409/** Instantiate thread data for the submodule.
2410 *
2411 */
2412static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
2413{
2414 rlm_radius_t *inst = talloc_get_type_abort(mctx->mi->data, rlm_radius_t);
2415 bio_thread_t *thread = talloc_get_type_abort(mctx->thread, bio_thread_t);
2416
2417 thread->ctx.el = mctx->el;
2418 thread->ctx.inst = inst;
2419 thread->ctx.fd_config = inst->fd_config;
2420 thread->ctx.radius_ctx = inst->common_ctx;
2421
2422 switch (inst->mode) {
2423 case RLM_RADIUS_MODE_XLAT_PROXY:
2424 fr_rb_expire_inline_talloc_init(&thread->bio.expires, home_server_t, expire, home_server_cmp, home_server_free,
2425 inst->home_server_lifetime);
2426 FALL_THROUGH;
2427
2428 default:
2429 thread->ctx.trunk = trunk_alloc(thread, mctx->el, &io_funcs,
2430 &inst->trunk_conf, inst->name, thread, false);
2431 if (!thread->ctx.trunk) return -1;
2432 return 0;
2433
2434 case RLM_RADIUS_MODE_REPLICATE:
2435 case RLM_RADIUS_MODE_UNCONNECTED_REPLICATE:
2436 break;
2437 }
2438
2439 /*
2440 * If we have a port range, allocate the source IP based
2441 * on the range start, plus the thread ID. This means
2442 * that we can avoid "hunt and peck" attempts to open up
2443 * the source port.
2444 */
2445 if (thread->ctx.fd_config.src_port_start) {
2446 thread->ctx.fd_config.src_port = thread->ctx.fd_config.src_port_start + fr_schedule_worker_id();
2447 }
2448
2449 /*
2450 * Allocate the unconnected replication socket.
2451 */
2452 thread->bio.fd = fr_bio_fd_alloc(thread, &thread->ctx.fd_config, 0);
2453 if (!thread->bio.fd) {
2454 PERROR("%s - failed opening socket", inst->name);
2455 return CONNECTION_STATE_FAILED;
2456 }
2457
2458 thread->bio.fd->uctx = thread;
2459 thread->ctx.fd_info = fr_bio_fd_info(thread->bio.fd);
2460 fr_assert(thread->ctx.fd_info != NULL);
2461
2462 (void) fr_bio_fd_write_only(thread->bio.fd);
2463
2464 DEBUG("%s - Opened unconnected replication socket %s", inst->name, thread->ctx.fd_info->name);
2465 return 0;
2466}
2467
2468static xlat_arg_parser_t const xlat_radius_send_args[] = {
2469 { .required = true, .single = true, .type = FR_TYPE_COMBO_IP_ADDR },
2470 { .required = true, .single = true, .type = FR_TYPE_UINT16 },
2471 { .required = true, .single = true, .type = FR_TYPE_STRING },
2472 XLAT_ARG_PARSER_TERMINATOR
2473};
2474
2475/*
2476 * %replicate.sendto.ipaddr(ipaddr, port, secret)
2477 */
2478static xlat_action_t xlat_radius_replicate(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out,
2479 xlat_ctx_t const *xctx,
2480 request_t *request, fr_value_box_list_t *args)
2481{
2482 bio_thread_t *thread = talloc_get_type_abort(xctx->mctx->thread, bio_thread_t);
2483 fr_value_box_t *ipaddr, *port, *secret;
2484 ssize_t packet_len;
2485 uint8_t buffer[4096];
2486 fr_radius_ctx_t radius_ctx;
2487 fr_radius_encode_ctx_t encode_ctx;
2488 fr_bio_fd_packet_ctx_t addr;
2489
2490 XLAT_ARGS(args, &ipaddr, &port, &secret);
2491
2492 /*
2493 * Can't change IP address families.
2494 */
2495 if (ipaddr->vb_ip.af != thread->ctx.fd_info->socket.af) {
2496 RPERROR("Invalid destination IP address family in %pV", ipaddr);
2497 return XLAT_ACTION_FAIL;
2498 }
2499
2500 /*
2501 * Warn if we're not replicating accounting data. It likely won't wokr/
2502 */
2503 if (request->packet->code != FR_RADIUS_CODE_ACCOUNTING_REQUEST) {
2504 RWDEBUG("Replication of packets other then Accounting-Request will likely not do what you want.");
2505 }
2506
2507 /*
2508 * Set up various context things.
2509 */
2510 radius_ctx = (fr_radius_ctx_t) {
2511 .secret = secret->vb_strvalue,
2512 .secret_length = secret->vb_length,
2513 .proxy_state = 0,
2514 };
2515
2516 encode_ctx = (fr_radius_encode_ctx_t) {
2517 .common = &radius_ctx,
2518 .rand_ctx = (fr_fast_rand_t) {
2519 .a = fr_rand(),
2520 .b = fr_rand(),
2521 },
2522 .code = request->packet->code,
2523 .id = thread->bio.id++ & 0xff,
2524 .add_proxy_state = false,
2525 };
2526
2527 /*
2528 * Encode the entire packet.
2529 */
2530 packet_len = fr_radius_encode(&FR_DBUFF_TMP(buffer, sizeof(buffer)),
2531 &request->request_pairs, &encode_ctx);
2532 if (fr_pair_encode_is_error(packet_len)) {
2533 RPERROR("Failed encoding packet");
2534 return XLAT_ACTION_FAIL;
2535 }
2536
2537 /*
2538 * Sign it.
2539 */
2540 if (fr_radius_sign(buffer, NULL, (uint8_t const *) radius_ctx.secret, radius_ctx.secret_length) < 0) {
2541 RERROR("Failed signing packet");
2542 return XLAT_ACTION_FAIL;
2543 }
2544
2545 /*
2546 * Prepare destination address.
2547 */
2548 addr = (fr_bio_fd_packet_ctx_t) {
2549 .socket = thread->ctx.fd_info->socket,
2550 };
2551 addr.socket.inet.dst_ipaddr = ipaddr->vb_ip;
2552 addr.socket.inet.dst_port = port->vb_uint16;
2553
2554 RDEBUG("Replicating packet to %pV:%u", ipaddr, port->vb_uint16);
2555
2556 /*
2557 * We either send it, or fail.
2558 */
2559 packet_len = fr_bio_write(thread->bio.fd, &addr, buffer, packet_len);
2560 if (packet_len < 0) {
2561 RPERROR("Failed sending packet to %pV:%u", ipaddr, port->vb_uint16);
2562 return XLAT_ACTION_FAIL;
2563 }
2564
2565 /*
2566 * No return value.
2567 */
2568 return XLAT_ACTION_DONE;
2569}
2570
2571// **********************************************************************
2572
2573/** Dynamic home server code
2574 *
2575 */
2576
2577static int8_t home_server_cmp(void const *one, void const *two)
2578{
2579 home_server_t const *a = one;
2580 home_server_t const *b = two;
2581 int8_t rcode;
2582
2583 rcode = fr_ipaddr_cmp(&a->ctx.fd_config.dst_ipaddr, &b->ctx.fd_config.dst_ipaddr);
2584 if (rcode != 0) return rcode;
2585
2586 return CMP(a->ctx.fd_config.dst_port, b->ctx.fd_config.dst_port);
2587}
2588
2589static xlat_action_t xlat_sendto_resume(TALLOC_CTX *ctx, fr_dcursor_t *out,
2590 xlat_ctx_t const *xctx,
2591 request_t *request, UNUSED fr_value_box_list_t *in)
2592{
2593 bio_request_t *u = talloc_get_type_abort(xctx->rctx, bio_request_t);
2594 fr_value_box_t *dst;
2595
2596 if (u->rcode == RLM_MODULE_FAIL) return XLAT_ACTION_FAIL;
2597
2598 MEM(dst = fr_value_box_alloc(ctx, FR_TYPE_UINT32, attr_packet_type));
2599 dst->vb_uint32 = request->reply->code;
2600
2601 fr_dcursor_append(out, dst);
2602
2603 return XLAT_ACTION_DONE;
2604}
2605
2606static void xlat_sendto_signal(xlat_ctx_t const *xctx, request_t *request, fr_signal_t action)
2607{
2608 rlm_radius_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_radius_t);
2609 bio_request_t *u = talloc_get_type_abort(xctx->rctx, bio_request_t);
2610
2611 do_signal(inst, u, request, action);
2612}
2613
2614/*
2615 * @todo - change this to mod_retry
2616 */
2617static void xlat_sendto_retry(xlat_ctx_t const *xctx, request_t *request, fr_retry_t const *retry)
2618{
2619 rlm_radius_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_radius_t);
2620 bio_request_t *u = talloc_get_type_abort(xctx->rctx, bio_request_t);
2621
2622 do_retry(inst, u, request, retry);
2623}
2624
2625/*
2626 * %proxy.sendto.ipaddr(ipaddr, port, secret)
2627 */
2628static xlat_action_t xlat_radius_client(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out,
2629 xlat_ctx_t const *xctx,
2630 request_t *request, fr_value_box_list_t *args)
2631{
2632 rlm_radius_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_radius_t);
2633 bio_thread_t *thread = talloc_get_type_abort(xctx->mctx->thread, bio_thread_t);
2634 fr_value_box_t *ipaddr, *port, *secret;
2635 home_server_t *home;
2636 bio_request_t *u = NULL;
2637 fr_retry_config_t const *retry_config = NULL;
2638 int rcode;
2639
2640 XLAT_ARGS(args, &ipaddr, &port, &secret);
2641
2642 /*
2643 * Can't change IP address families.
2644 */
2645 if (ipaddr->vb_ip.af != thread->ctx.fd_config.src_ipaddr.af) {
2646 RDEBUG("Invalid destination IP address family in %pV", ipaddr);
2647 return XLAT_ACTION_DONE;
2648 }
2649
2650 home = fr_rb_find(&thread->bio.expires.tree, &(home_server_t) {
2651 .ctx = {
2652 .fd_config = (fr_bio_fd_config_t) {
2653 .dst_ipaddr = ipaddr->vb_ip,
2654 .dst_port = port->vb_uint16,
2655 },
2656 },
2657 });
2658 if (!home) {
2659 MEM(home = talloc(thread, home_server_t));
2660
2661 *home = (home_server_t) {
2662 .ctx = (bio_handle_ctx_t) {
2663 .el = unlang_interpret_event_list(request),
2664 .module_name = inst->name,
2665 .inst = inst,
2666 },
2667 };
2668
2669 /*
2670 * Copy the home server configuration from the root configuration. Then update it with
2671 * the needs of the home server.
2672 */
2673 home->ctx.fd_config = inst->fd_config;
2674 home->ctx.fd_config.type = FR_BIO_FD_CONNECTED;
2675 home->ctx.fd_config.dst_ipaddr = ipaddr->vb_ip;
2676 home->ctx.fd_config.dst_port = port->vb_uint32;
2677
2678 home->ctx.radius_ctx = (fr_radius_ctx_t) {
2679 .secret = talloc_strdup(home, secret->vb_strvalue),
2680 .secret_length = secret->vb_length,
2681 .proxy_state = inst->common_ctx.proxy_state,
2682 };
2683
2684 /*
2685 * Allocate the trunk and start it up.
2686 */
2687 home->ctx.trunk = trunk_alloc(home, unlang_interpret_event_list(request), &io_funcs,
2688 &inst->trunk_conf, inst->name, home, false);
2689 if (!home->ctx.trunk) {
2690 fail:
2691 talloc_free(home);
2692 return XLAT_ACTION_FAIL;
2693 }
2694
2695 if (!fr_rb_expire_insert(&thread->bio.expires, home, fr_time())) goto fail;
2696 } else {
2697 fr_rb_expire_t *expire = &thread->bio.expires;
2698 fr_time_t now = fr_time();
2699 home_server_t *old;
2700
2701 /*
2702 * We can't change secrets on the fly. The home
2703 * server has to expire first, and then the
2704 * secret can be changed.
2705 */
2706 if ((home->ctx.radius_ctx.secret_length != secret->vb_length) ||
2707 (strcmp(home->ctx.radius_ctx.secret, secret->vb_strvalue) != 0)) {
2708 RWDEBUG("The new secret is not the same as the old secret: Ignoring the new one");
2709 }
2710
2711 fr_rb_expire_update(expire, home, now);
2712
2713 while ((old = fr_dlist_head(&expire->head)) != NULL) {
2714 (void) talloc_get_type_abort(old, home_server_t);
2715
2716 fr_assert(old->ctx.trunk);
2717
2718 /*
2719 * Don't delete the home server we're about to use.
2720 */
2721 if (old == home) break;
2722
2723 /*
2724 * It still has a request allocated, do nothing.
2725 */
2726 if (old->ctx.trunk->req_alloc) break;
2727
2728 /*
2729 * Not yet time to expire.
2730 */
2731 if (fr_time_gt(old->expire.when, now)) break;
2732
2733 fr_dlist_remove(&expire->head, old);
2734 fr_rb_delete(&expire->tree, old);
2735 }
2736 }
2737
2738 /*
2739 * Enqueue the packet on the per-home-server trunk.
2740 */
2741 rcode = mod_enqueue(&u, &retry_config, inst, home->ctx.trunk, request);
2742 if (rcode == 0) return XLAT_ACTION_DONE;
2743
2744 if (rcode < 0) {
2745 REDEBUG("Failed enqueuing packet");
2746 return XLAT_ACTION_FAIL;
2747 }
2748 fr_assert(u != NULL);
2749 fr_assert(retry_config != NULL);
2750
2751 /*
2752 * Start the retry.
2753 *
2754 * @todo - change unlang_xlat_timeout_add() to unlang_xlat_retry_add().
2755 */
2756 fr_retry_init(&u->retry, fr_time(), retry_config);
2757
2758 return unlang_xlat_yield_to_retry(request, xlat_sendto_resume, xlat_sendto_retry,
2759 xlat_sendto_signal, ~(FR_SIGNAL_CANCEL | FR_SIGNAL_DUP),
2760 u, retry_config);
2761}
unlang_action_t
unlang_action_t
Returned by unlang_op_t calls, determine the next action of the interpreter.
Definition action.h:35
buffer
static int const char char buffer[256]
Definition acutest.h:576
file
int const char * file
Definition acutest.h:702
args
va_list args
Definition acutest.h:770
line
int const char int line
Definition acutest.h:702
fr_bio_write
static ssize_t fr_bio_write(fr_bio_t *bio, void *packet_ctx, void const *buffer, size_t size)
Write raw data to a bio.
Definition base.h:172
fr_bio_read
static ssize_t fr_bio_read(fr_bio_t *bio, void *packet_ctx, void *buffer, size_t size)
Read raw data from a bio.
Definition base.h:149
fr_bio_s::uctx
void * uctx
user ctx, caller can manually set it.
Definition base.h:113
fr_bio_error
#define fr_bio_error(_x)
Definition base.h:192
fr_bio_s
Definition base.h:112
NDEBUG_UNUSED
#define NDEBUG_UNUSED
Definition build.h:328
FALL_THROUGH
#define FALL_THROUGH
clang 10 doesn't recognised the FALL-THROUGH comment anymore
Definition build.h:324
CMP_PREFER_SMALLER
#define CMP_PREFER_SMALLER(_a, _b)
Evaluates to +1 for a > b, and -1 for a < b.
Definition build.h:104
CC_NO_UBSAN
#define CC_NO_UBSAN(_sanitize)
Definition build.h:428
CMP
#define CMP(_a, _b)
Same as CMP_PREFER_SMALLER use when you don't really care about ordering, you just want an ordering.
Definition build.h:112
unlikely
#define unlikely(_x)
Definition build.h:383
UNUSED
#define UNUSED
Definition build.h:317
connection_state_t
connection_state_t
Definition connection.h:45
CONNECTION_STATE_FAILED
@ CONNECTION_STATE_FAILED
Connection has failed.
Definition connection.h:54
CONNECTION_STATE_CONNECTED
@ CONNECTION_STATE_CONNECTED
File descriptor is open (ready for writing).
Definition connection.h:52
CONNECTION_STATE_INIT
@ CONNECTION_STATE_INIT
Init state, sets up connection.
Definition connection.h:49
CONNECTION_STATE_CONNECTING
@ CONNECTION_STATE_CONNECTING
Waiting for connection to establish.
Definition connection.h:50
CONNECTION_FAILED
@ CONNECTION_FAILED
Connection is being reconnected because it failed.
Definition connection.h:84
connection_conf_t
Definition connection.h:91
connection_funcs_t
Holds a complete set of functions for a connection.
Definition connection.h:186
FR_DBUFF_TMP
#define FR_DBUFF_TMP(_start, _len_or_end)
Creates a compound literal to pass into functions which accept a dbuff.
Definition dbuff.h:514
fr_dcursor_append
static int fr_dcursor_append(fr_dcursor_t *cursor, void *v)
Insert a single item at the end of the list.
Definition dcursor.h:406
fr_dcursor_s
Definition dcursor.h:93
fr_assert_msg
#define fr_assert_msg(_x, _msg,...)
Calls panic_action ifndef NDEBUG, else logs error and causes the server to exit immediately with code...
Definition debug.h:210
fr_assert_fail
#define fr_assert_fail(_msg,...)
Calls panic_action ifndef NDEBUG, else logs error.
Definition debug.h:216
MEM
#define MEM(x)
Definition debug.h:36
FR_RADIUS_CODE_ACCESS_CHALLENGE
@ FR_RADIUS_CODE_ACCESS_CHALLENGE
RFC2865 - Access-Challenge.
Definition defs.h:43
FR_RADIUS_CODE_ACCESS_REQUEST
@ FR_RADIUS_CODE_ACCESS_REQUEST
RFC2865 - Access-Request.
Definition defs.h:33
FR_RADIUS_CODE_MAX
@ FR_RADIUS_CODE_MAX
Maximum possible protocol code.
Definition defs.h:53
FR_RADIUS_CODE_DISCONNECT_ACK
@ FR_RADIUS_CODE_DISCONNECT_ACK
RFC3575/RFC5176 - Disconnect-Ack (positive)
Definition defs.h:47
FR_RADIUS_CODE_ACCESS_ACCEPT
@ FR_RADIUS_CODE_ACCESS_ACCEPT
RFC2865 - Access-Accept.
Definition defs.h:34
FR_RADIUS_CODE_ACCOUNTING_RESPONSE
@ FR_RADIUS_CODE_ACCOUNTING_RESPONSE
RFC2866 - Accounting-Response.
Definition defs.h:37
FR_RADIUS_CODE_COA_NAK
@ FR_RADIUS_CODE_COA_NAK
RFC3575/RFC5176 - CoA-Nak (not willing to perform)
Definition defs.h:51
FR_RADIUS_CODE_COA_ACK
@ FR_RADIUS_CODE_COA_ACK
RFC3575/RFC5176 - CoA-Ack (positive)
Definition defs.h:50
FR_RADIUS_CODE_DISCONNECT_NAK
@ FR_RADIUS_CODE_DISCONNECT_NAK
RFC3575/RFC5176 - Disconnect-Nak (not willing to perform)
Definition defs.h:48
FR_RADIUS_CODE_PROTOCOL_ERROR
@ FR_RADIUS_CODE_PROTOCOL_ERROR
RFC7930 - Protocol-Error (generic NAK)
Definition defs.h:52
FR_RADIUS_CODE_ACCOUNTING_REQUEST
@ FR_RADIUS_CODE_ACCOUNTING_REQUEST
RFC2866 - Accounting-Request.
Definition defs.h:36
FR_RADIUS_CODE_ACCESS_REJECT
@ FR_RADIUS_CODE_ACCESS_REJECT
RFC2865 - Access-Reject.
Definition defs.h:35
attr_packet_type
static fr_dict_attr_t const * attr_packet_type
Definition dhcpclient.c:89
ERROR
#define ERROR(fmt,...)
Definition dhcpclient.c:41
DEBUG
#define DEBUG(fmt,...)
Definition dhcpclient.c:39
fr_dict_compatible
bool fr_dict_compatible(fr_dict_t const *dict1, fr_dict_t const *dict2)
See if two dictionaries have the same end parent.
Definition dict_util.c:2621
in
static fr_slen_t in
Definition dict.h:833
fr_dlist_head
static void * fr_dlist_head(fr_dlist_head_t const *list_head)
Return the HEAD item of a list or NULL if the list is empty.
Definition dlist.h:486
fr_dlist_remove
static void * fr_dlist_remove(fr_dlist_head_t *list_head, void *ptr)
Remove an item from the list.
Definition dlist.h:638
fr_event_fd_insert
#define fr_event_fd_insert(...)
Definition event.h:248
fr_event_fd_cb_t
void(* fr_event_fd_cb_t)(fr_event_list_t *el, int fd, int flags, void *uctx)
Called when an IO event occurs on a file descriptor.
Definition event.h:151
fr_bio_fd_connect_full
int fr_bio_fd_connect_full(fr_bio_t *bio, fr_event_list_t *el, fr_bio_callback_t connected_cb, fr_bio_callback_t error_cb, fr_time_delta_t *timeout, fr_bio_callback_t timeout_cb)
Finalize a connect()
Definition fd.c:1246
fr_bio_fd_alloc
fr_bio_t * fr_bio_fd_alloc(TALLOC_CTX *ctx, fr_bio_fd_config_t const *cfg, size_t offset)
Allocate a FD bio.
Definition fd.c:1026
fr_bio_fd_info
fr_bio_fd_info_t const * fr_bio_fd_info(fr_bio_t *bio)
Returns a pointer to the bio-specific information.
Definition fd.c:1343
fr_bio_fd_write_only
int fr_bio_fd_write_only(fr_bio_t *bio)
Mark up a bio as write-only.
Definition fd.c:1373
fr_bio_fd_info_t::socket
fr_socket_t socket
as connected socket
Definition fd.h:130
fr_bio_fd_info_t::name
char const * name
printable name of this BIO
Definition fd.h:135
fr_bio_fd_config_t::src_port
uint16_t src_port
our port
Definition fd.h:92
fr_bio_fd_info_t::eof
bool eof
are we at EOF?
Definition fd.h:139
FR_BIO_FD_CONNECTED
@ FR_BIO_FD_CONNECTED
connected client sockets (UDP or TCP)
Definition fd.h:68
fr_bio_fd_info_t::state
fr_bio_fd_state_t state
connecting, open, closed, etc.
Definition fd.h:133
fr_bio_fd_config_t::src_port_start
uint16_t src_port_start
limit source port ranges for client BIOs
Definition fd.h:95
FR_BIO_FD_STATE_CONNECTING
@ FR_BIO_FD_STATE_CONNECTING
Definition fd.h:60
FR_BIO_FD_STATE_OPEN
@ FR_BIO_FD_STATE_OPEN
error states must be before this
Definition fd.h:59
fr_bio_fd_info_t::connect_errno
int connect_errno
from connect() or other APIs
Definition fd.h:141
fr_bio_fd_config_t::dst_ipaddr
fr_ipaddr_t dst_ipaddr
their IP address
Definition fd.h:90
fr_bio_fd_config_t::socket_type
int socket_type
SOCK_STREAM or SOCK_DGRAM.
Definition fd.h:84
fr_bio_fd_config_t::dst_port
uint16_t dst_port
their port
Definition fd.h:93
fr_bio_fd_packet_ctx_t::socket
fr_socket_t socket
socket information, including FD.
Definition fd.h:52
fr_bio_fd_info_t::write_blocked
bool write_blocked
did we block on write?
Definition fd.h:138
fr_bio_fd_config_t::src_ipaddr
fr_ipaddr_t src_ipaddr
our IP address
Definition fd.h:89
fr_bio_fd_config_t
Configuration for sockets.
Definition fd.h:81
fr_bio_fd_info_t
Run-time status of the socket.
Definition fd.h:129
fr_bio_fd_packet_ctx_t
Per-packet context.
Definition fd.h:51
fr_ipaddr_cmp
int8_t fr_ipaddr_cmp(fr_ipaddr_t const *a, fr_ipaddr_t const *b)
Compare two ip addresses.
Definition inet.c:1346
fr_ipaddr_t::af
int af
Address family.
Definition inet.h:64
unlang_interpret_mark_runnable
void unlang_interpret_mark_runnable(request_t *request)
Mark a request as resumable.
Definition interpret.c:1418
unlang_interpret_event_list
fr_event_list_t * unlang_interpret_event_list(request_t *request)
Get the event list for the current interpreter.
Definition interpret.c:1822
fr_async_s
Minimal data structure to use the new code.
Definition listen.h:59
fr_pair_encode_is_error
static bool fr_pair_encode_is_error(ssize_t slen)
Determine if the return code for an encoding function is a fatal error.
Definition pair.h:74
fr_bio_mem_alloc
fr_bio_t * fr_bio_mem_alloc(TALLOC_CTX *ctx, size_t read_size, size_t write_size, fr_bio_t *next)
Allocate a memory buffer bio.
Definition mem.c:727
fr_bio_mem_set_verify
int fr_bio_mem_set_verify(fr_bio_t *bio, fr_bio_verify_t verify, void *verify_ctx, bool datagram)
Set the verification function for memory bios.
Definition mem.c:880
attr_eap_message
HIDDEN fr_dict_attr_t const * attr_eap_message
Definition base.c:96
log_request_pair_list
void log_request_pair_list(fr_log_lvl_t lvl, request_t *request, fr_pair_t const *parent, fr_pair_list_t const *vps, char const *prefix)
Print a fr_pair_list_t.
Definition log.c:828
PERROR
#define PERROR(_fmt,...)
Definition log.h:228
DEBUG3
#define DEBUG3(_fmt,...)
Definition log.h:266
RWDEBUG
#define RWDEBUG(fmt,...)
Definition log.h:361
RWARN
#define RWARN(fmt,...)
Definition log.h:297
RERROR
#define RERROR(fmt,...)
Definition log.h:298
DEBUG4
#define DEBUG4(_fmt,...)
Definition log.h:267
RPERROR
#define RPERROR(fmt,...)
Definition log.h:302
RINFO
#define RINFO(fmt,...)
Definition log.h:296
RPEDEBUG
#define RPEDEBUG(fmt,...)
Definition log.h:376
HEXDUMP3
#define HEXDUMP3(_data, _len, _fmt,...)
Definition log.h:723
RHEXDUMP3
#define RHEXDUMP3(_data, _len, _fmt,...)
Definition log.h:705
map_to_vp
int map_to_vp(TALLOC_CTX *ctx, fr_pair_list_t *out, request_t *request, map_t const *map, UNUSED void *uctx)
Convert a map to a fr_pair_t.
Definition map.c:1563
map_to_request
int map_to_request(request_t *request, map_t const *map, radius_map_getvalue_t func, void *ctx)
Convert map_t to fr_pair_t (s) and add them to a request_t.
Definition map.c:1842
talloc_free
talloc_free(reap)
fr_event_list_s
Stores all information relating to an event list.
Definition event.c:377
default_log
fr_log_t default_log
Definition log.c:288
fr_log
void fr_log(fr_log_t const *log, fr_log_type_t type, char const *file, int line, char const *fmt,...)
Send a server log message to its destination.
Definition log.c:580
L_DBG_LVL_3
@ L_DBG_LVL_3
3rd highest priority debug messages (-xxx | -Xx).
Definition log.h:72
L_DBG_LVL_2
@ L_DBG_LVL_2
2nd highest priority debug messages (-xx | -X).
Definition log.h:71
fr_log_type_t
fr_log_type_t
Definition log.h:54
L_ERR
@ L_ERR
Error message.
Definition log.h:56
fr_packet_alloc
fr_packet_t * fr_packet_alloc(TALLOC_CTX *ctx, bool new_vector)
Allocate a new fr_packet_t.
Definition packet.c:38
fr_bio_verify_action_t
fr_bio_verify_action_t
Status returned by the verification callback.
Definition mem.h:32
FR_BIO_VERIFY_ERROR_CLOSE
@ FR_BIO_VERIFY_ERROR_CLOSE
fatal error, the bio should be closed.
Definition mem.h:36
FR_BIO_VERIFY_DISCARD
@ FR_BIO_VERIFY_DISCARD
the packet should be discarded
Definition mem.h:34
FR_BIO_VERIFY_OK
@ FR_BIO_VERIFY_OK
packet is OK
Definition mem.h:33
FR_BIO_VERIFY_WANT_MORE
@ FR_BIO_VERIFY_WANT_MORE
not enough data for one packet
Definition mem.h:35
fr_radius_ok
bool fr_radius_ok(uint8_t const *packet, size_t *packet_len_p, uint32_t max_attributes, bool require_message_authenticator, decode_fail_t *reason)
Definition merged_model.c:253
FR_TYPE_STRING
@ FR_TYPE_STRING
String of printable characters.
Definition merged_model.c:83
FR_TYPE_UINT16
@ FR_TYPE_UINT16
16 Bit unsigned integer.
Definition merged_model.c:98
FR_TYPE_UINT32
@ FR_TYPE_UINT32
32 Bit unsigned integer.
Definition merged_model.c:99
FR_TYPE_COMBO_IP_ADDR
@ FR_TYPE_COMBO_IP_ADDR
IPv4 or IPv6 address depending on length.
Definition merged_model.c:91
uint32_t
unsigned int uint32_t
Definition merged_model.c:33
ssize_t
long int ssize_t
Definition merged_model.c:24
uint8_t
unsigned char uint8_t
Definition merged_model.c:30
fr_value_box_t
Definition merged_model.c:136
request_t
Definition merged_model.c:210
module_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition module_ctx.h:42
module_ctx_t::thread
void * thread
Thread specific instance data.
Definition module_ctx.h:43
module_ctx_t::rctx
void * rctx
Resume ctx that a module previously set.
Definition module_ctx.h:45
module_thread_inst_ctx_t::el
fr_event_list_t * el
Event list to register any IO handlers and timers against.
Definition module_ctx.h:68
module_thread_inst_ctx_t::thread
void * thread
Thread instance data.
Definition module_ctx.h:67
module_thread_inst_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition module_ctx.h:64
module_ctx_t
Temporary structure to hold arguments for module calls.
Definition module_ctx.h:41
module_thread_inst_ctx_t
Temporary structure to hold arguments for thread_instantiation calls.
Definition module_ctx.h:63
mod_enqueue
static int mod_enqueue(bio_request_t **p_u, fr_retry_config_t const **p_retry_config, rlm_radius_t const *inst, trunk_t *trunk, request_t *request)
Definition bio.c:2257
bio_handle_ctx_t::fd_config
fr_bio_fd_config_t fd_config
for threads or sockets
Definition bio.c:52
request_prioritise
static int8_t request_prioritise(void const *one, void const *two)
Definition bio.c:1034
do_retry
static void do_retry(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_retry_t const *retry)
Definition bio.c:1428
bio_request_s::ev
fr_timer_t * ev
timer for retransmissions
Definition bio.c:135
check_for_zombie
static bool check_for_zombie(fr_event_list_t *el, trunk_connection_t *tconn, fr_time_t now, fr_time_t last_sent)
See if the connection is zombied.
Definition bio.c:1325
conn_init_error
static void conn_init_error(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, void *uctx)
Connection errored.
Definition bio.c:332
request_demux
static void request_demux(UNUSED fr_event_list_t *el, trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
Definition bio.c:1908
conn_discard
static void conn_discard(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
Read and discard data.
Definition bio.c:918
bio_request_s::id
uint8_t id
Last ID assigned to this packet.
Definition bio.c:129
bio_handle_t::max_packet_size
uint32_t max_packet_size
Our max packet size. may be different from the parent.
Definition bio.c:89
do_signal
static void do_signal(rlm_radius_t const *inst, bio_request_t *u, request_t *request, fr_signal_t action)
bio_connected
static void bio_connected(fr_bio_t *bio)
Definition bio.c:627
bio_request_s::num_replies
uint32_t num_replies
number of reply packets, sent is in retry.count
Definition bio.c:121
io_funcs
static const trunk_io_funcs_t io_funcs
Definition bio.c:2397
bio_request_s::priority
uint32_t priority
copied from request->async->priority
Definition bio.c:118
radius_code_to_rcode
static rlm_rcode_t radius_code_to_rcode[FR_RADIUS_CODE_MAX]
Turn a reply code into a module rcode;.
Definition bio.c:148
conn_error
static void conn_error(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, int fd_errno, void *uctx)
Connection errored.
Definition bio.c:953
bio_handle_ctx_t::module_name
char const * module_name
the module that opened the connection
Definition bio.c:48
bio_handle_ctx_t::fd_info
fr_bio_fd_info_t const * fd_info
status of the FD.
Definition bio.c:53
mod_signal
static void mod_signal(module_ctx_t const *mctx, UNUSED request_t *request, fr_signal_t action)
Definition bio.c:2178
bio_handle_t::last_id
uint8_t last_id
Used when replicating to ensure IDs are distributed evenly.
Definition bio.c:86
mod_retry
static void mod_retry(module_ctx_t const *mctx, request_t *request, fr_retry_t const *retry)
Handle module retries.
Definition bio.c:1420
decode
static fr_radius_decode_fail_t decode(TALLOC_CTX *ctx, fr_pair_list_t *reply, uint8_t *response_code, bio_handle_t *h, request_t *request, bio_request_t *u, uint8_t const request_authenticator[static RADIUS_AUTH_VECTOR_LENGTH], uint8_t *data, size_t data_len)
Decode response packet data, extracting relevant information and validating the packet.
Definition bio.c:1073
conn_close
static void conn_close(UNUSED fr_event_list_t *el, void *handle, UNUSED void *uctx)
Shutdown/close a file descriptor.
Definition bio.c:835
thread_conn_notify
static void thread_conn_notify(trunk_connection_t *tconn, connection_t *conn, fr_event_list_t *el, trunk_connection_event_t notify_on, UNUSED void *uctx)
Definition bio.c:965
encode
static int encode(bio_handle_t *h, request_t *request, bio_request_t *u, uint8_t id)
Definition bio.c:1140
bio_handle_t::last_reply
fr_time_t last_reply
When we last received a reply.
Definition bio.c:97
request_conn_release
static void request_conn_release(connection_t *conn, void *preq_to_reset, UNUSED void *uctx)
Clear out anything associated with the handle from the request.
Definition bio.c:2104
bio_handle_t::fd
int fd
File descriptor.
Definition bio.c:75
bio_handle_t::status_u
bio_request_t * status_u
for sending status check packets
Definition bio.c:105
bio_thread_t::ctx
bio_handle_ctx_t ctx
common struct for home servers and BIO handles
Definition bio.c:58
rlm_radius_verify
static fr_bio_verify_action_t rlm_radius_verify(UNUSED fr_bio_t *bio, void *verify_ctx, UNUSED void *packet_ctx, const void *data, size_t *size)
Definition bio.c:646
mod_write
static void mod_write(request_t *request, trunk_request_t *treq, bio_handle_t *h)
Definition bio.c:1520
REQUIRE_MA
#define REQUIRE_MA(_h)
check
#define check(_handle, _len_p)
Definition bio.c:44
bio_request_s::extra
fr_pair_list_t extra
VPs for debugging, like Proxy-State.
Definition bio.c:126
bio_request_s::proxied
bool proxied
is this request being proxied
Definition bio.c:124
bio_handle_t::buflen
size_t buflen
Receive buffer length.
Definition bio.c:92
conn_init_readable
static void conn_init_readable(fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
Read the connection during the init and negotiation stage.
Definition bio.c:415
bio_handle_t::last_idle
fr_time_t last_idle
last time we had nothing to do
Definition bio.c:100
bio_tracking_entry_log
static void bio_tracking_entry_log(fr_log_t const *log, fr_log_type_t log_type, char const *file, int line, radius_track_entry_t *te)
Log additional information about a tracking entry.
Definition bio.c:191
xlat_radius_replicate
static xlat_action_t xlat_radius_replicate(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *args)
Definition bio.c:2478
bio_request_s::rr
radius_track_entry_t * rr
ID tracking, resend count, etc.
Definition bio.c:134
bio_request_s::packet_len
size_t packet_len
Length of the packet.
Definition bio.c:131
_bio_handle_free
static int _bio_handle_free(bio_handle_t *h)
Free a connection handle, closing associated resources.
Definition bio.c:610
bio_request_s::partial
size_t partial
partially sent data
Definition bio.c:132
bio_handle_ctx_t::el
fr_event_list_t * el
Event list.
Definition bio.c:50
request_cancel
static void request_cancel(UNUSED connection_t *conn, void *preq_to_reset, trunk_cancel_reason_t reason, UNUSED void *uctx)
Remove the request from any tracking structures.
Definition bio.c:2072
home_server_free
static void home_server_free(void *data)
Definition bio.c:2390
protocol_error_reply
static void protocol_error_reply(bio_request_t *u, bio_handle_t *h)
Deal with Protocol-Error replies, and possible negotiation.
Definition bio.c:1730
status_check_reset
static void status_check_reset(bio_handle_t *h, bio_request_t *u)
Reset a status_check packet, ready to reuse.
Definition bio.c:227
request_fail
static void request_fail(request_t *request, NDEBUG_UNUSED void *preq, void *rctx, NDEBUG_UNUSED trunk_request_state_t state, UNUSED void *uctx)
Write out a canned failure.
Definition bio.c:2126
bio_request_s::recv_time
fr_time_t recv_time
copied from request->async->recv_time
Definition bio.c:119
bio_request_s::retry
fr_retry_t retry
retransmission timers
Definition bio.c:136
conn_init_writable
static void conn_init_writable(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
xlat_radius_client
static xlat_action_t xlat_radius_client(UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *args)
Definition bio.c:2628
bio_request_s::rcode
rlm_rcode_t rcode
from the transport
Definition bio.c:115
status_check_alloc
static void status_check_alloc(bio_handle_t *h)
Definition bio.c:244
bio_handle_t::mrs_time
fr_time_t mrs_time
Most recent sent time which had a reply.
Definition bio.c:96
bio_handle_t::status_checking
bool status_checking
whether we're doing status checks
Definition bio.c:104
bio_handle_ctx_t::trunk
trunk_t * trunk
trunk handler
Definition bio.c:51
bio_handle_t::last_sent
fr_time_t last_sent
last time we sent a packet.
Definition bio.c:99
zombie_timeout
static void zombie_timeout(fr_timer_list_t *tl, fr_time_t now, void *uctx)
Mark a connection dead after "zombie_interval".
Definition bio.c:1267
home_server_t::ctx
bio_handle_ctx_t ctx
for copying to bio_handle_t
Definition bio.c:140
mod_thread_instantiate
static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
Instantiate thread data for the submodule.
Definition bio.c:2412
bio_error
static void bio_error(fr_bio_t *bio)
Definition bio.c:636
status_check_reply
static void status_check_reply(trunk_request_t *treq, fr_time_t now)
Deal with replies replies to status checks and possible negotiation.
Definition bio.c:1860
mod_resume
static unlang_action_t mod_resume(rlm_rcode_t *p_result, module_ctx_t const *mctx, UNUSED request_t *request)
Resume execution of the request, returning the rcode set during trunk execution.
Definition bio.c:2166
conn_init_next
static void conn_init_next(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
Perform the next step of init and negotiation.
Definition bio.c:401
bio_request_s::is_retry
bool is_retry
Definition bio.c:116
_bio_request_free
static int _bio_request_free(bio_request_t *u)
Free a bio_request_t.
Definition bio.c:2236
bio_handle_t::conn
connection_t * conn
Definition bio.c:84
bio_handle_t::first_sent
fr_time_t first_sent
first time we sent a packet since going idle
Definition bio.c:98
bio_handle_t::zombie_ev
fr_timer_t * zombie_ev
Zombie timeout.
Definition bio.c:102
thread_conn_alloc
static connection_t * thread_conn_alloc(trunk_connection_t *tconn, fr_event_list_t *el, connection_conf_t const *conf, char const *log_prefix, void *uctx)
Definition bio.c:889
xlat_sendto_retry
static void xlat_sendto_retry(xlat_ctx_t const *xctx, request_t *request, fr_retry_t const *retry)
Definition bio.c:2617
bio_request_reset
static void bio_request_reset(bio_request_t *u)
Clear out any connection specific resources from a udp request.
Definition bio.c:210
bio_request_s::treq
trunk_request_t * treq
Definition bio.c:114
xlat_sendto_resume
static xlat_action_t xlat_sendto_resume(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, UNUSED fr_value_box_list_t *in)
Definition bio.c:2589
status_check_next
static void status_check_next(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
Handle retries for a status check.
Definition bio.c:1845
bio_handle_ctx_t::inst
rlm_radius_t const * inst
our instance
Definition bio.c:49
conn_init
static connection_state_t conn_init(void **h_out, connection_t *conn, void *uctx)
Initialise a new outbound connection.
Definition bio.c:708
home_server_t::expire
fr_rb_expire_node_t expire
Definition bio.c:142
revive_timeout
static void revive_timeout(UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
Revive a connection after "revive_interval".
Definition bio.c:1255
bio_request_s::packet
uint8_t * packet
Packet we write to the network.
Definition bio.c:130
conn_init_timeout
static void conn_init_timeout(UNUSED fr_timer_list_t *tl, fr_time_t now, void *uctx)
Status check timer when opening the connection for the first time.
Definition bio.c:353
conn_failed
static connection_state_t conn_failed(void *handle, connection_state_t state, UNUSED void *uctx)
Connection failed.
Definition bio.c:862
bio_handle_ctx_t::radius_ctx
fr_radius_ctx_t radius_ctx
Definition bio.c:54
bio_handle_t::tt
radius_track_t * tt
RADIUS ID tracking structure.
Definition bio.c:94
mod_dup
static void mod_dup(request_t *request, bio_request_t *u)
Definition bio.c:1384
bio_handle_t::ctx
bio_handle_ctx_t ctx
common struct for home servers and BIO handles
Definition bio.c:73
home_server_cmp
static int8_t home_server_cmp(void const *one, void const *two)
Dynamic home server code.
Definition bio.c:2577
bio_request_s::code
uint8_t code
Packet code.
Definition bio.c:128
request_mux
static void request_mux(UNUSED fr_event_list_t *el, trunk_connection_t *tconn, connection_t *conn, UNUSED void *uctx)
Definition bio.c:1501
bio_handle_t::buffer
uint8_t * buffer
Receive buffer.
Definition bio.c:91
bio_handle_t::status_request
request_t * status_request
Definition bio.c:106
request_complete
static void request_complete(request_t *request, NDEBUG_UNUSED void *preq, void *rctx, UNUSED void *uctx)
Response has already been written to the rctx at this point.
Definition bio.c:2148
bio_handle_t::bio
struct bio_handle_t::@179 bio
bio_request_s::status_check
bool status_check
is this packet a status check?
Definition bio.c:123
xlat_radius_send_args
static xlat_arg_parser_t const xlat_radius_send_args[]
Definition bio.c:2468
xlat_sendto_signal
static void xlat_sendto_signal(xlat_ctx_t const *xctx, request_t *request, fr_signal_t action)
Definition bio.c:2606
bio_thread_t::bio
struct bio_thread_t::@178 bio
bio_handle_ctx_t
Definition bio.c:47
bio_handle_t
Track the handle, which is tightly correlated with the FD.
Definition bio.c:72
bio_request_s
Connect request_t to local tracking structure.
Definition bio.c:113
bio_thread_t
Definition bio.c:57
home_server_t
Definition bio.c:139
fr_nbo_to_uint16
static uint16_t fr_nbo_to_uint16(uint8_t const data[static sizeof(uint16_t)])
Read an unsigned 16bit integer from wire format (big endian)
Definition nbo.h:146
RADIUS_HEADER_LENGTH
#define RADIUS_HEADER_LENGTH
Definition net.h:80
RADIUS_AUTH_VECTOR_LENGTH
#define RADIUS_AUTH_VECTOR_LENGTH
Definition net.h:89
fr_pair_value_memdup
int fr_pair_value_memdup(fr_pair_t *vp, uint8_t const *src, size_t len, bool tainted)
Copy data into an "octets" data type.
Definition pair.c:2937
fr_pair_value_strdup
int fr_pair_value_strdup(fr_pair_t *vp, char const *src, bool tainted)
Copy data into an "string" data type.
Definition pair.c:2637
fr_pair_find_by_da
fr_pair_t * fr_pair_find_by_da(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find the first pair with a matching da.
Definition pair.c:695
fr_pair_append
int fr_pair_append(fr_pair_list_t *list, fr_pair_t *to_add)
Add a VP to the end of the list.
Definition pair.c:1347
fr_pair_delete_by_da
int fr_pair_delete_by_da(fr_pair_list_t *list, fr_dict_attr_t const *da)
Delete matching pairs from the specified list.
Definition pair.c:1691
fr_pair_afrom_da
fr_pair_t * fr_pair_afrom_da(TALLOC_CTX *ctx, fr_dict_attr_t const *da)
Dynamically allocate a new attribute and assign a fr_dict_attr_t.
Definition pair.c:285
fr_pair_list_init
void fr_pair_list_init(fr_pair_list_t *list)
Initialise a pair list header.
Definition pair.c:46
encode_ctx
static fr_internal_encode_ctx_t encode_ctx
Definition proto_ldap_sync.c:34
fr_radius_decode
ssize_t fr_radius_decode(TALLOC_CTX *ctx, fr_pair_list_t *out, uint8_t *packet, size_t packet_len, fr_radius_decode_ctx_t *decode_ctx)
Definition base.c:1086
fr_radius_sign
int fr_radius_sign(uint8_t *packet, uint8_t const *vector, uint8_t const *secret, size_t secret_len)
Sign a previously encoded packet.
Definition base.c:358
fr_radius_encode
ssize_t fr_radius_encode(fr_dbuff_t *dbuff, fr_pair_list_t *vps, fr_radius_encode_ctx_t *packet_ctx)
Definition base.c:951
fr_radius_packet_name
char const * fr_radius_packet_name[FR_RADIUS_CODE_MAX]
Definition base.c:112
fr_assert
#define fr_assert(_expr)
Definition rad_assert.h:38
dict_radius
static fr_dict_t const * dict_radius
Definition radclient-ng.c:105
secret
static char * secret
Definition radclient-ng.c:69
attr_proxy_state
static fr_dict_attr_t const * attr_proxy_state
Definition radclient.c:128
REDEBUG
#define REDEBUG(fmt,...)
Definition radclient.h:52
RDEBUG
#define RDEBUG(fmt,...)
Definition radclient.h:53
WARN
#define WARN(fmt,...)
Definition radclient.h:47
INFO
#define INFO(fmt,...)
Definition radict.c:54
FR_RADIUS_REQUIRE_MA_AUTO
@ FR_RADIUS_REQUIRE_MA_AUTO
Only require Message-Authenticator if we've previously received a packet from this client with Messag...
Definition radius.h:65
RADIUS_AUTH_VECTOR_OFFSET
#define RADIUS_AUTH_VECTOR_OFFSET
Definition radius.h:33
fr_radius_decode_fail_t
fr_radius_decode_fail_t
Failure reasons.
Definition radius.h:162
DECODE_FAIL_UNKNOWN
@ DECODE_FAIL_UNKNOWN
Definition radius.h:179
DECODE_FAIL_NONE
@ DECODE_FAIL_NONE
Definition radius.h:163
DECODE_FAIL_UNKNOWN_PACKET_CODE
@ DECODE_FAIL_UNKNOWN_PACKET_CODE
Definition radius.h:169
fr_radius_ctx_t::secret
char const * secret
Definition radius.h:95
RADIUS_MAX_PACKET_SIZE
#define RADIUS_MAX_PACKET_SIZE
Definition radius.h:41
fr_radius_ctx_t::secret_length
size_t secret_length
Definition radius.h:96
fr_radius_decode_ctx_t::common
fr_radius_ctx_t const * common
Definition radius.h:125
fr_radius_decode_ctx_t::tmp_ctx
TALLOC_CTX * tmp_ctx
for temporary things cleaned up during decoding
Definition radius.h:129
fr_radius_ctx_t
Definition radius.h:94
fr_radius_decode_ctx_t
Definition radius.h:124
fr_radius_encode_ctx_t
Definition radius.h:103
conf
static rs_t * conf
Definition radsniff.c:53
attr_extended_attribute_1
static fr_dict_attr_t const * attr_extended_attribute_1
Definition radsnmp.c:108
attr_message_authenticator
static fr_dict_attr_t const * attr_message_authenticator
Definition radsnmp.c:112
fr_rand
uint32_t fr_rand(void)
Return a 32-bit random number.
Definition rand.c:105
fr_fast_rand_t
Smaller fast random number generator.
Definition rand.h:54
fr_rb_find
void * fr_rb_find(fr_rb_tree_t const *tree, void const *data)
Find an element in the tree, returning the data, not the node.
Definition rb.c:577
fr_rb_delete
bool fr_rb_delete(fr_rb_tree_t *tree, void const *data)
Remove node and free data (if a free function was specified)
Definition rb.c:741
fr_rb_expire_insert
bool fr_rb_expire_insert(fr_rb_expire_t *expire, void *data, fr_time_t now)
Attempt to find current data in the tree, if it does not exist insert it.
Definition rb_expire.c:39
fr_rb_expire_update
void fr_rb_expire_update(fr_rb_expire_t *expire, void *data, fr_time_t now)
Definition rb_expire.c:55
fr_rb_expire_inline_talloc_init
#define fr_rb_expire_inline_talloc_init(_expire, _type, _field, _data_cmp, _data_free, _lifetime)
Definition rb_expire.h:50
fr_rb_expire_t::head
fr_dlist_head_t head
Definition rb_expire.h:35
fr_rb_expire_node_t::when
fr_time_t when
Definition rb_expire.h:47
fr_rb_expire_t::tree
fr_rb_tree_t tree
Definition rb_expire.h:34
fr_rb_expire_node_t
dlist for expiring old entries
Definition rb_expire.h:44
fr_rb_expire_t
Definition rb_expire.h:33
RETURN_MODULE_RCODE
#define RETURN_MODULE_RCODE(_rcode)
Definition rcode.h:64
rlm_rcode_t
rlm_rcode_t
Return codes indicating the result of the module call.
Definition rcode.h:40
RLM_MODULE_OK
@ RLM_MODULE_OK
The module is OK, continue.
Definition rcode.h:43
RLM_MODULE_FAIL
@ RLM_MODULE_FAIL
Module failed, don't reply.
Definition rcode.h:42
RLM_MODULE_REJECT
@ RLM_MODULE_REJECT
Immediately reject the request.
Definition rcode.h:41
RLM_MODULE_UPDATED
@ RLM_MODULE_UPDATED
OK (pairs modified).
Definition rcode.h:49
RLM_MODULE_HANDLED
@ RLM_MODULE_HANDLED
The module handled the request, so stop.
Definition rcode.h:44
request_local_alloc_external
#define request_local_alloc_external(_ctx, _args)
Allocate a new external request outside of the request pool.
Definition request.h:331
request_init_args_t
Optional arguments for initialising requests.
Definition request.h:283
attr_error_cause
static fr_dict_attr_t const * attr_error_cause
Definition rlm_radius.c:192
radius_fixups
static int radius_fixups(rlm_radius_t const *inst, request_t *request)
Do any RADIUS-layer fixups for proxying.
Definition rlm_radius.c:523
attr_nas_identifier
static fr_dict_attr_t const * attr_nas_identifier
Definition rlm_radius.c:197
attr_original_packet_code
static fr_dict_attr_t const * attr_original_packet_code
Definition rlm_radius.c:198
attr_event_timestamp
static fr_dict_attr_t const * attr_event_timestamp
Definition rlm_radius.c:193
attr_response_length
static fr_dict_attr_t const * attr_response_length
Definition rlm_radius.c:199
rlm_radius_s::revive_interval
fr_time_delta_t revive_interval
Definition rlm_radius.h:60
rlm_radius_s::retry
fr_retry_config_t retry[FR_RADIUS_CODE_MAX]
Definition rlm_radius.h:92
rlm_radius_s::name
char const * name
Definition rlm_radius.h:56
rlm_radius_s::status_check
uint32_t status_check
code of status-check type
Definition rlm_radius.h:84
rlm_radius_s::mode
rlm_radius_mode_t mode
proxy, client, etc.
Definition rlm_radius.h:76
RLM_RADIUS_MODE_XLAT_PROXY
@ RLM_RADIUS_MODE_XLAT_PROXY
Definition rlm_radius.h:47
RLM_RADIUS_MODE_INVALID
@ RLM_RADIUS_MODE_INVALID
Definition rlm_radius.h:42
RLM_RADIUS_MODE_PROXY
@ RLM_RADIUS_MODE_PROXY
Definition rlm_radius.h:43
RLM_RADIUS_MODE_REPLICATE
@ RLM_RADIUS_MODE_REPLICATE
Definition rlm_radius.h:45
RLM_RADIUS_MODE_UNCONNECTED_REPLICATE
@ RLM_RADIUS_MODE_UNCONNECTED_REPLICATE
Definition rlm_radius.h:46
RLM_RADIUS_MODE_CLIENT
@ RLM_RADIUS_MODE_CLIENT
Definition rlm_radius.h:44
rlm_radius_s::max_packet_size
uint32_t max_packet_size
Maximum packet size.
Definition rlm_radius.h:66
rlm_radius_s::response_window
fr_time_delta_t response_window
Definition rlm_radius.h:58
rlm_radius_s::max_attributes
uint32_t max_attributes
Maximum number of attributes to decode in response.
Definition rlm_radius.h:78
rlm_radius_s::zombie_period
fr_time_delta_t zombie_period
Definition rlm_radius.h:59
rlm_radius_s
Definition rlm_radius.h:53
retry_config
static conf_parser_t retry_config[]
Definition rlm_tacacs.c:38
fr_schedule_worker_id
int fr_schedule_worker_id(void)
Return the worker id for the current thread.
Definition schedule.c:157
connection_signal_reconnect
void connection_signal_reconnect(connection_t *conn, connection_reason_t reason)
Asynchronously signal the connection should be reconnected.
Definition connection.c:1167
connection_signal_on_fd
int connection_signal_on_fd(connection_t *conn, int fd)
Setup the connection to change states to connected or failed based on I/O events.
Definition connection.c:1405
connection_alloc
connection_t * connection_alloc(TALLOC_CTX *ctx, fr_event_list_t *el, connection_funcs_t const *funcs, connection_conf_t const *conf, char const *log_prefix, void const *uctx)
Allocate a new connection.
Definition connection.c:1511
connection_signal_connected
void connection_signal_connected(connection_t *conn)
Asynchronously signal that the connection is open.
Definition connection.c:1137
connection_s
Definition connection.c:87
module_instance_s::data
void * data
Module's instance data.
Definition module.h:272
pair_append_request
#define pair_append_request(_attr, _da)
Allocate and append a fr_pair_t to the request list.
Definition pair.h:37
fr_signal_t
fr_signal_t
Signals that can be generated/processed by request signal handlers.
Definition signal.h:38
FR_SIGNAL_DUP
@ FR_SIGNAL_DUP
A duplicate request was received.
Definition signal.h:44
FR_SIGNAL_CANCEL
@ FR_SIGNAL_CANCEL
Request has been cancelled.
Definition signal.h:40
inst
eap_aka_sim_process_conf_t * inst
Definition state_machine.c:3620
vp
fr_pair_t * vp
Definition state_machine.c:2262
eap_aka_sim_process_conf_t::type
eap_type_t type
The preferred EAP-Type of this instance of the EAP-SIM/AKA/AKA' state machine.
Definition state_machine.h:188
fr_time
#define fr_time()
Allow us to arbitrarily manipulate time.
Definition state_test.c:8
fr_log_s
Definition log.h:96
map_s
Value pair map.
Definition map.h:77
pair_list_s
Definition pair.h:52
value_pair_s
Stores an attribute, a value and various bits of other data.
Definition pair.h:68
fr_syserror
char const * fr_syserror(int num)
Guaranteed to be thread-safe version of strerror.
Definition syserror.c:243
talloc_get_type_abort_const
#define talloc_get_type_abort_const
Definition talloc.h:282
talloc_const_free
static int talloc_const_free(void const *ptr)
Free const'd memory.
Definition talloc.h:224
fr_time_gteq
#define fr_time_gteq(_a, _b)
Definition time.h:238
fr_time_unwrap
static int64_t fr_time_unwrap(fr_time_t time)
Definition time.h:146
fr_time_wrap
#define fr_time_wrap(_time)
Definition time.h:145
fr_time_lteq
#define fr_time_lteq(_a, _b)
Definition time.h:240
fr_time_eq
#define fr_time_eq(_a, _b)
Definition time.h:241
fr_time_add
#define fr_time_add(_a, _b)
Add a time/time delta together.
Definition time.h:196
fr_time_gt
#define fr_time_gt(_a, _b)
Definition time.h:237
fr_time_sub
#define fr_time_sub(_a, _b)
Subtract one time from another.
Definition time.h:229
fr_time_to_unix_time
static fr_unix_time_t fr_time_to_unix_time(fr_time_t when)
Convert an fr_time_t (internal time) to our version of unix time (wallclock time)
Definition time.h:688
fr_time_lt
#define fr_time_lt(_a, _b)
Definition time.h:239
fr_time_s
"server local" time.
Definition time.h:69
fr_timer_list_s
An event timer list.
Definition timer.c:49
fr_timer_s
A timer event.
Definition timer.c:75
fr_timer_armed
#define fr_timer_armed(_ev)
Definition timer.h:117
FR_TIMER_DELETE_RETURN
#define FR_TIMER_DELETE_RETURN(_ev_p)
Definition timer.h:109
FR_TIMER_DISARM
#define FR_TIMER_DISARM(_ev)
Definition timer.h:90
fr_timer_at
#define fr_timer_at(...)
Definition timer.h:80
radius_track_state_log
void radius_track_state_log(fr_log_t const *log, fr_log_type_t log_type, char const *file, int line, radius_track_t *tt, radius_track_log_extra_t extra)
Print out the state of every tracking entry.
Definition track.c:294
radius_track_entry_update
int radius_track_entry_update(radius_track_entry_t *te, uint8_t const *vector)
Update a tracking entry with the authentication vector.
Definition track.c:219
radius_track_entry_find
radius_track_entry_t * radius_track_entry_find(radius_track_t *tt, uint8_t packet_id, uint8_t const *vector)
Find a tracking entry from a request authenticator.
Definition track.c:248
radius_track_alloc
radius_track_t * radius_track_alloc(TALLOC_CTX *ctx)
Create an radius_track_t.
Definition track.c:41
radius_track_entry_release
#define radius_track_entry_release(_te)
Definition track.h:90
radius_track_entry_s::uctx
void * uctx
Result/resumption context.
Definition track.h:47
radius_track_entry_s::id
uint8_t id
our ID
Definition track.h:50
radius_track_s::num_requests
unsigned int num_requests
number of requests in the allocation
Definition track.h:65
radius_track_entry_reserve
#define radius_track_entry_reserve(_te_out, _ctx, _tt, _request, _code, _uctx)
Definition track.h:82
radius_track_entry_s::request
request_t * request
as always...
Definition track.h:45
radius_track_entry_s
Track one request to a response.
Definition track.h:36
radius_track_s
Definition track.h:64
trunk_connection_callback_readable
void trunk_connection_callback_readable(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
Standard I/O read function.
Definition trunk.c:4013
trunk_connection_callback_writable
void trunk_connection_callback_writable(UNUSED fr_event_list_t *el, UNUSED int fd, UNUSED int flags, void *uctx)
Standard I/O write function.
Definition trunk.c:4030
trunk_request_signal_partial
void trunk_request_signal_partial(trunk_request_t *treq)
Signal a partial write.
Definition trunk.c:2028
trunk_request_signal_fail
void trunk_request_signal_fail(trunk_request_t *treq)
Signal that a trunk request failed.
Definition trunk.c:2131
trunk_request_alloc
trunk_request_t * trunk_request_alloc(trunk_t *trunk, request_t *request)
(Pre-)Allocate a new trunk request
Definition trunk.c:2473
trunk_alloc
trunk_t * trunk_alloc(TALLOC_CTX *ctx, fr_event_list_t *el, trunk_io_funcs_t const *funcs, trunk_conf_t const *conf, char const *log_prefix, void const *uctx, bool delay_start)
Allocate a new collection of connections.
Definition trunk.c:4945
trunk_connection_requests_requeue
uint64_t trunk_connection_requests_requeue(trunk_connection_t *tconn, int states, uint64_t max, bool fail_bound)
Move requests off of a connection and requeue elsewhere.
Definition trunk.c:2009
trunk_request_enqueue_on_conn
trunk_enqueue_t trunk_request_enqueue_on_conn(trunk_request_t **treq_out, trunk_connection_t *tconn, request_t *request, void *preq, void *rctx, bool ignore_limits)
Enqueue additional requests on a specific connection.
Definition trunk.c:2740
trunk_request_enqueue
trunk_enqueue_t trunk_request_enqueue(trunk_request_t **treq_out, trunk_t *trunk, request_t *request, void *preq, void *rctx)
Enqueue a request that needs data written to the trunk.
Definition trunk.c:2586
trunk_request_requeue
trunk_enqueue_t trunk_request_requeue(trunk_request_t *treq)
Re-enqueue a request on the same connection.
Definition trunk.c:2675
trunk_connection_pop_request
int trunk_connection_pop_request(trunk_request_t **treq_out, trunk_connection_t *tconn)
Pop a request off a connection's pending queue.
Definition trunk.c:3882
trunk_request_signal_cancel
void trunk_request_signal_cancel(trunk_request_t *treq)
Cancel a trunk request.
Definition trunk.c:2151
trunk_request_free
void trunk_request_free(trunk_request_t **treq_to_free)
If the trunk request is freed then update the target requests.
Definition trunk.c:2321
trunk_connection_signal_active
void trunk_connection_signal_active(trunk_connection_t *tconn)
Signal a trunk connection is no longer full.
Definition trunk.c:3959
trunk_connection_signal_inactive
void trunk_connection_signal_inactive(trunk_connection_t *tconn)
Signal a trunk connection cannot accept more requests.
Definition trunk.c:3936
trunk_request_signal_sent
void trunk_request_signal_sent(trunk_request_t *treq)
Signal that the request was written to a connection successfully.
Definition trunk.c:2049
trunk_request_signal_complete
void trunk_request_signal_complete(trunk_request_t *treq)
Signal that a trunk request is complete.
Definition trunk.c:2093
trunk_connection_signal_reconnect
void trunk_connection_signal_reconnect(trunk_connection_t *tconn, connection_reason_t reason)
Signal a trunk connection is no longer viable.
Definition trunk.c:3998
trunk_request_state_log
void trunk_request_state_log(fr_log_t const *log, fr_log_type_t log_type, char const *file, int line, trunk_request_t const *treq)
Definition trunk.c:2827
trunk_connection_s
Associates request queues with a connection.
Definition trunk.c:133
trunk_request_s
Wraps a normal request.
Definition trunk.c:99
trunk_s
Main trunk management handle.
Definition trunk.c:197
TRUNK_REQUEST_STATE_ALL
#define TRUNK_REQUEST_STATE_ALL
All request states.
Definition trunk.h:195
trunk_io_funcs_t::connection_alloc
trunk_connection_alloc_t connection_alloc
Allocate a new connection_t.
Definition trunk.h:733
trunk_connection_event_t
trunk_connection_event_t
What type of I/O events the trunk connection is currently interested in receiving.
Definition trunk.h:72
TRUNK_CONN_EVENT_BOTH
@ TRUNK_CONN_EVENT_BOTH
Trunk should be notified if a connection is readable or writable.
Definition trunk.h:79
TRUNK_CONN_EVENT_WRITE
@ TRUNK_CONN_EVENT_WRITE
Trunk should be notified if a connection is writable.
Definition trunk.h:77
TRUNK_CONN_EVENT_NONE
@ TRUNK_CONN_EVENT_NONE
Don't notify the trunk on connection state changes.
Definition trunk.h:73
TRUNK_CONN_EVENT_READ
@ TRUNK_CONN_EVENT_READ
Trunk should be notified if a connection is readable.
Definition trunk.h:75
trunk_cancel_reason_t
trunk_cancel_reason_t
Reasons for a request being cancelled.
Definition trunk.h:55
TRUNK_CANCEL_REASON_REQUEUE
@ TRUNK_CANCEL_REASON_REQUEUE
A previously sent request is being requeued.
Definition trunk.h:59
TRUNK_ENQUEUE_DST_UNAVAILABLE
@ TRUNK_ENQUEUE_DST_UNAVAILABLE
Destination is down.
Definition trunk.h:153
TRUNK_ENQUEUE_FAIL
@ TRUNK_ENQUEUE_FAIL
General failure.
Definition trunk.h:154
TRUNK_ENQUEUE_OK
@ TRUNK_ENQUEUE_OK
Operation was successful.
Definition trunk.h:150
TRUNK_ENQUEUE_NO_CAPACITY
@ TRUNK_ENQUEUE_NO_CAPACITY
At maximum number of connections, and no connection has capacity.
Definition trunk.h:151
TRUNK_ENQUEUE_IN_BACKLOG
@ TRUNK_ENQUEUE_IN_BACKLOG
Request should be enqueued in backlog.
Definition trunk.h:149
trunk_request_state_t
trunk_request_state_t
Used for sanity checks and to simplify freeing.
Definition trunk.h:161
TRUNK_REQUEST_STATE_PARTIAL
@ TRUNK_REQUEST_STATE_PARTIAL
Some of the request was written to the socket, more of it should be written later.
Definition trunk.h:170
TRUNK_REQUEST_STATE_REAPABLE
@ TRUNK_REQUEST_STATE_REAPABLE
Request has been written, needs to persist, but we are not currently waiting for any response.
Definition trunk.h:173
TRUNK_REQUEST_STATE_UNASSIGNED
@ TRUNK_REQUEST_STATE_UNASSIGNED
Transition state - Request currently not assigned to any connection.
Definition trunk.h:165
TRUNK_REQUEST_STATE_INIT
@ TRUNK_REQUEST_STATE_INIT
Initial state.
Definition trunk.h:162
TRUNK_REQUEST_STATE_CANCEL_SENT
@ TRUNK_REQUEST_STATE_CANCEL_SENT
We've informed the remote server that the request has been cancelled.
Definition trunk.h:185
TRUNK_REQUEST_STATE_COMPLETE
@ TRUNK_REQUEST_STATE_COMPLETE
The request is complete.
Definition trunk.h:182
TRUNK_REQUEST_STATE_FAILED
@ TRUNK_REQUEST_STATE_FAILED
The request failed.
Definition trunk.h:183
TRUNK_REQUEST_STATE_CANCEL
@ TRUNK_REQUEST_STATE_CANCEL
A request on a particular socket was cancel.
Definition trunk.h:184
TRUNK_REQUEST_STATE_CANCEL_PARTIAL
@ TRUNK_REQUEST_STATE_CANCEL_PARTIAL
We partially wrote a cancellation request.
Definition trunk.h:187
TRUNK_REQUEST_STATE_BACKLOG
@ TRUNK_REQUEST_STATE_BACKLOG
In the backlog.
Definition trunk.h:167
TRUNK_REQUEST_STATE_CANCEL_COMPLETE
@ TRUNK_REQUEST_STATE_CANCEL_COMPLETE
Remote server has acknowledged our cancellation.
Definition trunk.h:188
TRUNK_REQUEST_STATE_PENDING
@ TRUNK_REQUEST_STATE_PENDING
In the queue of a connection and is pending writing.
Definition trunk.h:168
TRUNK_REQUEST_STATE_SENT
@ TRUNK_REQUEST_STATE_SENT
Was written to a socket. Waiting for a response.
Definition trunk.h:172
trunk_io_funcs_t
I/O functions to pass to trunk_alloc.
Definition trunk.h:732
el
static fr_event_list_t * el
Definition unit_test_attribute.c:279
unlang_xlat_yield_to_retry
xlat_action_t unlang_xlat_yield_to_retry(request_t *request, xlat_func_t resume, fr_unlang_xlat_retry_t retry, xlat_func_signal_t signal, fr_signal_t sigmask, void *rctx, fr_retry_config_t const *retry_cfg)
Yield a request back to the interpreter, with retries.
Definition xlat.c:687
xlat_arg_parser_t::required
bool required
Argument must be present, and non-empty.
Definition xlat.h:145
XLAT_ARGS
#define XLAT_ARGS(_list,...)
Populate local variables with value boxes from the input list.
Definition xlat.h:379
XLAT_ARG_PARSER_TERMINATOR
#define XLAT_ARG_PARSER_TERMINATOR
Definition xlat.h:166
xlat_action_t
xlat_action_t
Definition xlat.h:37
XLAT_ACTION_FAIL
@ XLAT_ACTION_FAIL
An xlat function failed.
Definition xlat.h:44
XLAT_ACTION_DONE
@ XLAT_ACTION_DONE
We're done evaluating this level of nesting.
Definition xlat.h:43
xlat_arg_parser_t
Definition for a single argument consumend by an xlat function.
Definition xlat.h:144
fr_pair_list_empty
bool fr_pair_list_empty(fr_pair_list_t const *list)
Is a valuepair list empty.
Definition pair_inline.c:124
fr_pair_list_free
void fr_pair_list_free(fr_pair_list_t *list)
Free memory used by a valuepair list.
Definition pair_inline.c:112
fr_pair_list_append
void fr_pair_list_append(fr_pair_list_t *dst, fr_pair_list_t *src)
Appends a list of fr_pair_t from a temporary list to a destination list.
Definition pair_inline.c:181
fr_retry_next
fr_retry_state_t fr_retry_next(fr_retry_t *r, fr_time_t now)
Initialize a retransmission counter.
Definition retry.c:108
fr_retry_init
void fr_retry_init(fr_retry_t *r, fr_time_t now, fr_retry_config_t const *config)
Initialize a retransmission counter.
Definition retry.c:36
fr_retry_t::start
fr_time_t start
when we started the retransmission
Definition retry.h:53
fr_retry_t::rt
fr_time_delta_t rt
retransmit interval
Definition retry.h:57
fr_retry_config_t::mrc
uint32_t mrc
Maximum retransmission count.
Definition retry.h:36
fr_retry_t::config
fr_retry_config_t const * config
master configuration
Definition retry.h:52
fr_retry_t::state
fr_retry_state_t state
so callers can see what state it's in.
Definition retry.h:60
FR_RETRY_MRC
@ FR_RETRY_MRC
reached maximum retransmission count
Definition retry.h:47
FR_RETRY_CONTINUE
@ FR_RETRY_CONTINUE
Definition retry.h:46
FR_RETRY_MRD
@ FR_RETRY_MRD
reached maximum retransmission duration
Definition retry.h:48
fr_retry_t::count
uint32_t count
number of sent packets
Definition retry.h:58
fr_retry_config_t::mrd
fr_time_delta_t mrd
Maximum retransmission duration.
Definition retry.h:35
fr_retry_t::updated
fr_time_t updated
last update, really a cached "now".
Definition retry.h:56
fr_retry_t::next
fr_time_t next
when the next timer should be set
Definition retry.h:55
fr_retry_config_t
Definition retry.h:32
fr_retry_t
Definition retry.h:51
fr_socket_t::af
int af
AF_INET, AF_INET6, or AF_UNIX.
Definition socket.h:78
fr_socket_t::fd
int fd
File descriptor if this is a live socket.
Definition socket.h:81
fr_strerror
char const * fr_strerror(void)
Get the last library error.
Definition strerror.c:553
fr_value_box_alloc
#define fr_value_box_alloc(_ctx, _type, _enumv)
Allocate a value box of a specific type.
Definition value.h:632
data
static fr_slen_t data
Definition value.h:1274
fr_box_time_delta
#define fr_box_time_delta(_val)
Definition value.h:354
nonnull
int nonnull(2, 5))
out
static size_t char ** out
Definition value.h:1012
xlat_ctx_s::rctx
void * rctx
Resume context.
Definition xlat_ctx.h:54
xlat_ctx_s::mctx
module_ctx_t const * mctx
Synthesised module calling ctx.
Definition xlat_ctx.h:52
xlat_ctx_s
An xlat calling ctx.
Definition xlat_ctx.h:49
Generated by   doxygen 1.9.8