src/main/listen.c

   1 /*
   2  * listen.c     Handle socket stuff
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2005,2006  The FreeRADIUS server project
  21  * Copyright 2005  Alan DeKok <aland@ox.org>
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include <freeradius-devel/radiusd.h>
  28 #include <freeradius-devel/modules.h>
  29 #include <freeradius-devel/rad_assert.h>
  30 #include <freeradius-devel/vqp.h>
  31 #include <freeradius-devel/dhcp.h>
  32
  33 #include <freeradius-devel/vmps.h>
  34 #include <freeradius-devel/detail.h>
  35
  36 #ifdef WITH_UDPFROMTO
  37 #include <freeradius-devel/udpfromto.h>
  38 #endif
  39
  40 #ifdef HAVE_SYS_RESOURCE_H
  41 #include <sys/resource.h>
  42 #endif
  43
  44 #ifdef HAVE_NET_IF_H
  45 #include <net/if.h>
  46 #endif
  47
  48 #ifdef HAVE_FCNTL_H
  49 #include <fcntl.h>
  50 #endif
  51
  52
  53 /*
  54  *      We'll use this below.
  55  */
  56 typedef int (*rad_listen_parse_t)(CONF_SECTION *, rad_listen_t *);
  57 typedef void (*rad_listen_free_t)(rad_listen_t *);
  58
  59 typedef struct rad_listen_master_t {
  60         rad_listen_parse_t      parse;
  61         rad_listen_free_t       free;
  62         rad_listen_recv_t       recv;
  63         rad_listen_send_t       send;
  64         rad_listen_print_t      print;
  65         rad_listen_encode_t     encode;
  66         rad_listen_decode_t     decode;
  67 } rad_listen_master_t;
  68
  69 typedef struct listen_socket_t {
  70         /*
  71          *      For normal sockets.
  72          */
  73         fr_ipaddr_t     ipaddr;
  74         int             port;
  75 #ifdef SO_BINDTODEVICE
  76         const char              *interface;
  77 #endif
  78         RADCLIENT_LIST  *clients;
  79 } listen_socket_t;
  80
  81 static rad_listen_t *listen_alloc(RAD_LISTEN_TYPE type);
  82
  83 /*
  84  *      Find a per-socket client.
  85  */
  86 RADCLIENT *client_listener_find(const rad_listen_t *listener,
  87                                 const fr_ipaddr_t *ipaddr, int src_port)
  88 {
  89 #ifdef WITH_DYNAMIC_CLIENTS
  90         int rcode;
  91         REQUEST *request;
  92         RADCLIENT *created;
  93 #endif
  94         time_t now;
  95         RADCLIENT *client;
  96         RADCLIENT_LIST *clients;
  97
  98         rad_assert(listener != NULL);
  99         rad_assert(ipaddr != NULL);
 100
 101         clients = ((listen_socket_t *)listener->data)->clients;
 102
 103         /*
 104          *      This HAS to have been initialized previously.
 105          */
 106         rad_assert(clients != NULL);
 107
 108         client = client_find(clients, ipaddr
 109 #ifdef WITH_TCP
 110                              , IPPROTO_UDP
 111 #endif
 112                              );
 113         if (!client) {
 114                 static time_t last_printed = 0;
 115                 char name[256], buffer[128];
 116
 117 #ifdef WITH_DYNAMIC_CLIENTS
 118         unknown:                /* used only for dynamic clients */
 119 #endif
 120
 121                 /*
 122                  *      DoS attack quenching, but only in debug mode.
 123                  *      If they're running in debug mode, show them
 124                  *      every packet.
 125                  */
 126                 if (debug_flag == 0) {
 127                         now = time(NULL);
 128                         if (last_printed == now) return NULL;
 129
 130                         last_printed = now;
 131                 }
 132
 133                 listener->print(listener, name, sizeof(name));
 134
 135                 radlog(L_ERR, "Ignoring request to %s from unknown client %s port %d",
 136                        name, inet_ntop(ipaddr->af, &ipaddr->ipaddr,
 137                                        buffer, sizeof(buffer)),
 138                        src_port);
 139                 return NULL;
 140         }
 141
 142 #ifndef WITH_DYNAMIC_CLIENTS
 143         return client;          /* return the found client. */
 144 #else
 145
 146         /*
 147          *      No server defined, and it's not dynamic.  Return it.
 148          */
 149         if (!client->client_server && !client->dynamic) return client;
 150
 151         now = time(NULL);
 152
 153         /*
 154          *      It's a dynamically generated client, check it.
 155          */
 156         if (client->dynamic && (src_port != 0)) {
 157                 /*
 158                  *      Lives forever.  Return it.
 159                  */
 160                 if (client->lifetime == 0) return client;
 161
 162                 /*
 163                  *      Rate-limit the deletion of known clients.
 164                  *      This makes them last a little longer, but
 165                  *      prevents the server from melting down if (say)
 166                  *      10k clients all expire at once.
 167                  */
 168                 if (now == client->last_new_client) return client;
 169
 170                 /*
 171                  *      It's not dead yet.  Return it.
 172                  */
 173                 if ((client->created + client->lifetime) > now) return client;
 174
 175                 /*
 176                  *      This really puts them onto a queue for later
 177                  *      deletion.
 178                  */
 179                 client_delete(clients, client);
 180
 181                 /*
 182                  *      Go find the enclosing network again.
 183                  */
 184                 client = client_find(clients, ipaddr
 185 #ifdef WITH_TCP
 186                                      , IPPROTO_UDP
 187 #endif
 188                                      );
 189
 190                 /*
 191                  *      WTF?
 192                  */
 193                 if (!client) goto unknown;
 194                 if (!client->client_server) goto unknown;
 195
 196                 /*
 197                  *      At this point, 'client' is the enclosing
 198                  *      network that configures where dynamic clients
 199                  *      can be defined.
 200                  */
 201                 rad_assert(client->dynamic == 0);
 202         } else {
 203                 /*
 204                  *      The IP is unknown, so we've found an enclosing
 205                  *      network.  Enable DoS protection.  We only
 206                  *      allow one new client per second.  Known
 207                  *      clients aren't subject to this restriction.
 208                  */
 209                 if (now == client->last_new_client) goto unknown;
 210         }
 211
 212         client->last_new_client = now;
 213
 214         request = request_alloc();
 215         if (!request) goto unknown;
 216
 217         request->listener = listener;
 218         request->client = client;
 219         request->packet = rad_recv(listener->fd, 0x02); /* MSG_PEEK */
 220         if (!request->packet) {                         /* badly formed, etc */
 221                 request_free(&request);
 222                 goto unknown;
 223         }
 224         request->reply = rad_alloc_reply(request->packet);
 225         if (!request->reply) {
 226                 request_free(&request);
 227                 goto unknown;
 228         }
 229         request->packet->timestamp = request->timestamp;
 230         request->number = 0;
 231         request->priority = listener->type;
 232         request->server = client->client_server;
 233         request->root = &mainconfig;
 234
 235         /*
 236          *      Run a fake request through the given virtual server.
 237          *      Look for FreeRADIUS-Client-IP-Address
 238          *               FreeRADIUS-Client-Secret
 239          *              ...
 240          *
 241          *      and create the RADCLIENT structure from that.
 242          */
 243         DEBUG("server %s {", request->server);
 244
 245         rcode = module_authorize(0, request);
 246
 247         DEBUG("} # server %s", request->server);
 248
 249         if (rcode != RLM_MODULE_OK) {
 250                 request_free(&request);
 251                 goto unknown;
 252         }
 253
 254         /*
 255          *      If the client was updated by rlm_dynamic_clients,
 256          *      don't create the client from attribute-value pairs.
 257          */
 258         if (request->client == client) {
 259                 created = client_create(clients, request);
 260         } else {
 261                 created = request->client;
 262
 263                 /*
 264                  *      This frees the client if it isn't valid.
 265                  */
 266                 if (!client_validate(clients, client, created)) goto unknown;
 267         }
 268         request_free(&request);
 269
 270         if (!created) goto unknown;
 271
 272         return created;
 273 #endif
 274 }
 275
 276 static int listen_bind(rad_listen_t *this);
 277
 278
 279 /*
 280  *      Process and reply to a server-status request.
 281  *      Like rad_authenticate and rad_accounting this should
 282  *      live in it's own file but it's so small we don't bother.
 283  */
 284 static int rad_status_server(REQUEST *request)
 285 {
 286         int rcode = RLM_MODULE_OK;
 287         DICT_VALUE *dval;
 288
 289         switch (request->listener->type) {
 290 #ifdef WITH_STATS
 291         case RAD_LISTEN_NONE:
 292 #endif
 293         case RAD_LISTEN_AUTH:
 294                 dval = dict_valbyname(PW_AUTZ_TYPE, "Status-Server");
 295                 if (dval) {
 296                         rcode = module_authorize(dval->value, request);
 297                 } else {
 298                         rcode = RLM_MODULE_OK;
 299                 }
 300
 301                 switch (rcode) {
 302                 case RLM_MODULE_OK:
 303                 case RLM_MODULE_UPDATED:
 304                         request->reply->code = PW_AUTHENTICATION_ACK;
 305                         break;
 306
 307                 case RLM_MODULE_FAIL:
 308                 case RLM_MODULE_HANDLED:
 309                         request->reply->code = 0; /* don't reply */
 310                         break;
 311
 312                 default:
 313                 case RLM_MODULE_REJECT:
 314                         request->reply->code = PW_AUTHENTICATION_REJECT;
 315                         break;
 316                 }
 317                 break;
 318
 319 #ifdef WITH_ACCOUNTING
 320         case RAD_LISTEN_ACCT:
 321                 dval = dict_valbyname(PW_ACCT_TYPE, "Status-Server");
 322                 if (dval) {
 323                         rcode = module_accounting(dval->value, request);
 324                 } else {
 325                         rcode = RLM_MODULE_OK;
 326                 }
 327
 328                 switch (rcode) {
 329                 case RLM_MODULE_OK:
 330                 case RLM_MODULE_UPDATED:
 331                         request->reply->code = PW_ACCOUNTING_RESPONSE;
 332                         break;
 333
 334                 default:
 335                         request->reply->code = 0; /* don't reply */
 336                         break;
 337                 }
 338                 break;
 339 #endif
 340
 341 #ifdef WITH_COA
 342                 /*
 343                  *      This is a vendor extension.  Suggested by Glen
 344                  *      Zorn in IETF 72, and rejected by the rest of
 345                  *      the WG.  We like it, so it goes in here.
 346                  */
 347         case RAD_LISTEN_COA:
 348                 dval = dict_valbyname(PW_RECV_COA_TYPE, "Status-Server");
 349                 if (dval) {
 350                         rcode = module_recv_coa(dval->value, request);
 351                 } else {
 352                         rcode = RLM_MODULE_OK;
 353                 }
 354
 355                 switch (rcode) {
 356                 case RLM_MODULE_OK:
 357                 case RLM_MODULE_UPDATED:
 358                         request->reply->code = PW_COA_ACK;
 359                         break;
 360
 361                 default:
 362                         request->reply->code = 0; /* don't reply */
 363                         break;
 364                 }
 365                 break;
 366 #endif
 367
 368         default:
 369                 return 0;
 370         }
 371
 372 #ifdef WITH_STATS
 373         /*
 374          *      Full statistics are available only on a statistics
 375          *      socket.
 376          */
 377         if (request->listener->type == RAD_LISTEN_NONE) {
 378                 request_stats_reply(request);
 379         }
 380 #endif
 381
 382         return 0;
 383 }
 384
 385
 386 static int socket_print(rad_listen_t *this, char *buffer, size_t bufsize)
 387 {
 388         size_t len;
 389         listen_socket_t *sock = this->data;
 390         const char *name;
 391
 392         switch (this->type) {
 393 #ifdef WITH_STATS
 394         case RAD_LISTEN_NONE:   /* what a hack... */
 395                 name = "status";
 396                 break;
 397 #endif
 398
 399         case RAD_LISTEN_AUTH:
 400                 name = "authentication";
 401                 break;
 402
 403 #ifdef WITH_ACCOUNTING
 404         case RAD_LISTEN_ACCT:
 405                 name = "accounting";
 406                 break;
 407 #endif
 408
 409 #ifdef WITH_PROXY
 410         case RAD_LISTEN_PROXY:
 411                 name = "proxy";
 412                 break;
 413 #endif
 414
 415 #ifdef WITH_VMPS
 416         case RAD_LISTEN_VQP:
 417                 name = "vmps";
 418                 break;
 419 #endif
 420
 421 #ifdef WITH_DHCP
 422         case RAD_LISTEN_DHCP:
 423                 name = "dhcp";
 424                 break;
 425 #endif
 426
 427 #ifdef WITH_COA
 428         case RAD_LISTEN_COA:
 429                 name = "coa";
 430                 break;
 431 #endif
 432
 433         default:
 434                 name = "??";
 435                 break;
 436         }
 437
 438 #define FORWARD len = strlen(buffer); if (len >= (bufsize + 1)) return 0;buffer += len;bufsize -= len
 439 #define ADDSTRING(_x) strlcpy(buffer, _x, bufsize);FORWARD
 440
 441         ADDSTRING(name);
 442
 443 #ifdef SO_BINDTODEVICE
 444         if (sock->interface) {
 445                 ADDSTRING(" interface ");
 446                 ADDSTRING(sock->interface);
 447         }
 448 #endif
 449
 450         ADDSTRING(" address ");
 451
 452         if ((sock->ipaddr.af == AF_INET) &&
 453             (sock->ipaddr.ipaddr.ip4addr.s_addr == htonl(INADDR_ANY))) {
 454                 strlcpy(buffer, "*", bufsize);
 455         } else {
 456                 ip_ntoh(&sock->ipaddr, buffer, bufsize);
 457         }
 458         FORWARD;
 459
 460         ADDSTRING(" port ");
 461         snprintf(buffer, bufsize, "%d", sock->port);
 462         FORWARD;
 463
 464         if (this->server) {
 465                 ADDSTRING(" as server ");
 466                 ADDSTRING(this->server);
 467         }
 468
 469 #undef ADDSTRING
 470 #undef FORWARD
 471
 472         return 1;
 473 }
 474
 475
 476 /*
 477  *      Parse an authentication or accounting socket.
 478  */
 479 static int common_socket_parse(CONF_SECTION *cs, rad_listen_t *this)
 480 {
 481         int             rcode;
 482         int             listen_port;
 483         fr_ipaddr_t     ipaddr;
 484         listen_socket_t *sock = this->data;
 485         char            *section_name = NULL;
 486         CONF_SECTION    *client_cs, *parentcs;
 487
 488         /*
 489          *      Try IPv4 first
 490          */
 491         ipaddr.ipaddr.ip4addr.s_addr = htonl(INADDR_NONE);
 492         rcode = cf_item_parse(cs, "ipaddr", PW_TYPE_IPADDR,
 493                               &ipaddr.ipaddr.ip4addr, NULL);
 494         if (rcode < 0) return -1;
 495
 496         if (rcode == 0) { /* successfully parsed IPv4 */
 497                 ipaddr.af = AF_INET;
 498
 499         } else {        /* maybe IPv6? */
 500                 rcode = cf_item_parse(cs, "ipv6addr", PW_TYPE_IPV6ADDR,
 501                                       &ipaddr.ipaddr.ip6addr, NULL);
 502                 if (rcode < 0) return -1;
 503
 504                 if (rcode == 1) {
 505                         cf_log_err(cf_sectiontoitem(cs),
 506                                    "No address specified in listen section");
 507                         return -1;
 508                 }
 509                 ipaddr.af = AF_INET6;
 510         }
 511
 512         rcode = cf_item_parse(cs, "port", PW_TYPE_INTEGER,
 513                               &listen_port, "0");
 514         if (rcode < 0) return -1;
 515
 516         if ((listen_port < 0) || (listen_port > 65535)) {
 517                         cf_log_err(cf_sectiontoitem(cs),
 518                                    "Invalid value for \"port\"");
 519                         return -1;
 520         }
 521
 522         sock->ipaddr = ipaddr;
 523         sock->port = listen_port;
 524
 525         /*
 526          *      If we can bind to interfaces, do so,
 527          *      else don't.
 528          */
 529         if (cf_pair_find(cs, "interface")) {
 530 #ifndef SO_BINDTODEVICE
 531                 cf_log_err(cf_sectiontoitem(cs),
 532                            "System does not support binding to interfaces.  Delete this line from the configuration file.");
 533                 return -1;
 534 #else
 535                 const char *value;
 536                 CONF_PAIR *cp = cf_pair_find(cs, "interface");
 537
 538                 rad_assert(cp != NULL);
 539                 value = cf_pair_value(cp);
 540                 if (!value) {
 541                         cf_log_err(cf_sectiontoitem(cs),
 542                                    "No interface name given");
 543                         return -1;
 544                 }
 545                 sock->interface = value;
 546 #endif
 547         }
 548
 549         /*
 550          *      And bind it to the port.
 551          */
 552         if (listen_bind(this) < 0) {
 553                 char buffer[128];
 554                 cf_log_err(cf_sectiontoitem(cs),
 555                            "Error binding to port for %s port %d",
 556                            ip_ntoh(&sock->ipaddr, buffer, sizeof(buffer)),
 557                            sock->port);
 558                 return -1;
 559         }
 560
 561 #ifdef WITH_PROXY
 562         /*
 563          *      Proxy sockets don't have clients.
 564          */
 565         if (this->type == RAD_LISTEN_PROXY) return 0;
 566 #endif
 567
 568         /*
 569          *      The more specific configurations are preferred to more
 570          *      generic ones.
 571          */
 572         client_cs = NULL;
 573         parentcs = cf_top_section(cs);
 574         rcode = cf_item_parse(cs, "clients", PW_TYPE_STRING_PTR,
 575                               &section_name, NULL);
 576         if (rcode < 0) return -1; /* bad string */
 577         if (rcode == 0) {
 578                 /*
 579                  *      Explicit list given: use it.
 580                  */
 581                 client_cs = cf_section_sub_find_name2(parentcs,
 582                                                       "clients",
 583                                                       section_name);
 584                 if (!client_cs) {
 585                         client_cs = cf_section_find(section_name);
 586                 }
 587                 if (!client_cs) {
 588                         cf_log_err(cf_sectiontoitem(cs),
 589                                    "Failed to find clients %s {...}",
 590                                    section_name);
 591                         free(section_name);
 592                         return -1;
 593                 }
 594                 free(section_name);
 595         } /* else there was no "clients = " entry. */
 596
 597         if (!client_cs) {
 598                 CONF_SECTION *server_cs;
 599
 600                 server_cs = cf_section_sub_find_name2(parentcs,
 601                                                       "server",
 602                                                       this->server);
 603                 /*
 604                  *      Found a "server foo" section.  If there are clients
 605                  *      in it, use them.
 606                  */
 607                 if (server_cs &&
 608                     (cf_section_sub_find(server_cs, "client") != NULL)) {
 609                         client_cs = server_cs;
 610                 }
 611         }
 612
 613         /*
 614          *      Still nothing.  Look for global clients.
 615          */
 616         if (!client_cs) client_cs = parentcs;
 617
 618         sock->clients = clients_parse_section(client_cs);
 619         if (!sock->clients) {
 620                 cf_log_err(cf_sectiontoitem(cs),
 621                            "Failed to load clients for this listen section");
 622                 return -1;
 623         }
 624
 625         return 0;
 626 }
 627
 628 /*
 629  *      Send an authentication response packet
 630  */
 631 static int auth_socket_send(rad_listen_t *listener, REQUEST *request)
 632 {
 633         rad_assert(request->listener == listener);
 634         rad_assert(listener->send == auth_socket_send);
 635
 636         return rad_send(request->reply, request->packet,
 637                         request->client->secret);
 638 }
 639
 640
 641 #ifdef WITH_ACCOUNTING
 642 /*
 643  *      Send an accounting response packet (or not)
 644  */
 645 static int acct_socket_send(rad_listen_t *listener, REQUEST *request)
 646 {
 647         rad_assert(request->listener == listener);
 648         rad_assert(listener->send == acct_socket_send);
 649
 650         /*
 651          *      Accounting reject's are silently dropped.
 652          *
 653          *      We do it here to avoid polluting the rest of the
 654          *      code with this knowledge
 655          */
 656         if (request->reply->code == 0) return 0;
 657
 658         return rad_send(request->reply, request->packet,
 659                         request->client->secret);
 660 }
 661 #endif
 662
 663 #ifdef WITH_PROXY
 664 /*
 665  *      Send a packet to a home server.
 666  *
 667  *      FIXME: have different code for proxy auth & acct!
 668  */
 669 static int proxy_socket_send(rad_listen_t *listener, REQUEST *request)
 670 {
 671         listen_socket_t *sock = listener->data;
 672
 673         rad_assert(request->proxy_listener == listener);
 674         rad_assert(listener->send == proxy_socket_send);
 675
 676         request->proxy->src_ipaddr = sock->ipaddr;
 677         request->proxy->src_port = sock->port;
 678
 679         return rad_send(request->proxy, request->packet,
 680                         request->home_server->secret);
 681 }
 682 #endif
 683
 684 #ifdef WITH_STATS
 685 /*
 686  *      Check if an incoming request is "ok"
 687  *
 688  *      It takes packets, not requests.  It sees if the packet looks
 689  *      OK.  If so, it does a number of sanity checks on it.
 690   */
 691 static int stats_socket_recv(rad_listen_t *listener,
 692                             RAD_REQUEST_FUNP *pfun, REQUEST **prequest)
 693 {
 694         ssize_t         rcode;
 695         int             code, src_port;
 696         RADIUS_PACKET   *packet;
 697         RADCLIENT       *client;
 698         fr_ipaddr_t     src_ipaddr;
 699
 700         rcode = rad_recv_header(listener->fd, &src_ipaddr, &src_port, &code);
 701         if (rcode < 0) return 0;
 702
 703         RAD_STATS_TYPE_INC(listener, total_requests);
 704
 705         if (rcode < 20) {       /* AUTH_HDR_LEN */
 706                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 707                 return 0;
 708         }
 709
 710         if ((client = client_listener_find(listener,
 711                                            &src_ipaddr, src_port)) == NULL) {
 712                 rad_recv_discard(listener->fd);
 713                 RAD_STATS_TYPE_INC(listener, total_invalid_requests);
 714                 return 0;
 715         }
 716
 717         /*
 718          *      We only understand Status-Server on this socket.
 719          */
 720         if (code != PW_STATUS_SERVER) {
 721                 DEBUG("Ignoring packet code %d sent to Status-Server port",
 722                       code);
 723                 rad_recv_discard(listener->fd);
 724                 RAD_STATS_TYPE_INC(listener, total_unknown_types);
 725                 RAD_STATS_CLIENT_INC(listener, client, total_unknown_types);
 726                 return 0;
 727         }
 728
 729         /*
 730          *      Now that we've sanity checked everything, receive the
 731          *      packet.
 732          */
 733         packet = rad_recv(listener->fd, 1); /* require message authenticator */
 734         if (!packet) {
 735                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 736                 DEBUG("%s", fr_strerror());
 737                 return 0;
 738         }
 739
 740         if (!received_request(listener, packet, prequest, client)) {
 741                 RAD_STATS_TYPE_INC(listener, total_packets_dropped);
 742                 RAD_STATS_CLIENT_INC(listener, client, total_packets_dropped);
 743                 rad_free(&packet);
 744                 return 0;
 745         }
 746
 747         *pfun = rad_status_server;
 748         return 1;
 749 }
 750 #endif
 751
 752
 753 /*
 754  *      Check if an incoming request is "ok"
 755  *
 756  *      It takes packets, not requests.  It sees if the packet looks
 757  *      OK.  If so, it does a number of sanity checks on it.
 758   */
 759 static int auth_socket_recv(rad_listen_t *listener,
 760                             RAD_REQUEST_FUNP *pfun, REQUEST **prequest)
 761 {
 762         ssize_t         rcode;
 763         int             code, src_port;
 764         RADIUS_PACKET   *packet;
 765         RAD_REQUEST_FUNP fun = NULL;
 766         RADCLIENT       *client;
 767         fr_ipaddr_t     src_ipaddr;
 768
 769         rcode = rad_recv_header(listener->fd, &src_ipaddr, &src_port, &code);
 770         if (rcode < 0) return 0;
 771
 772         RAD_STATS_TYPE_INC(listener, total_requests);
 773
 774         if (rcode < 20) {       /* AUTH_HDR_LEN */
 775                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 776                 return 0;
 777         }
 778
 779         if ((client = client_listener_find(listener,
 780                                            &src_ipaddr, src_port)) == NULL) {
 781                 rad_recv_discard(listener->fd);
 782                 RAD_STATS_TYPE_INC(listener, total_invalid_requests);
 783                 return 0;
 784         }
 785
 786         /*
 787          *      Some sanity checks, based on the packet code.
 788          */
 789         switch(code) {
 790         case PW_AUTHENTICATION_REQUEST:
 791                 RAD_STATS_CLIENT_INC(listener, client, total_requests);
 792                 fun = rad_authenticate;
 793                 break;
 794
 795         case PW_STATUS_SERVER:
 796                 if (!mainconfig.status_server) {
 797                         rad_recv_discard(listener->fd);
 798                         RAD_STATS_TYPE_INC(listener, total_packets_dropped);
 799                         RAD_STATS_CLIENT_INC(listener, client, total_packets_dropped);
 800                         DEBUG("WARNING: Ignoring Status-Server request due to security configuration");
 801                         return 0;
 802                 }
 803                 fun = rad_status_server;
 804                 break;
 805
 806         default:
 807                 rad_recv_discard(listener->fd);
 808                 RAD_STATS_INC(radius_auth_stats.total_unknown_types);
 809                 RAD_STATS_CLIENT_INC(listener, client, total_unknown_types);
 810
 811                 DEBUG("Invalid packet code %d sent to authentication port from client %s port %d : IGNORED",
 812                       code, client->shortname, src_port);
 813                 return 0;
 814                 break;
 815         } /* switch over packet types */
 816
 817         /*
 818          *      Now that we've sanity checked everything, receive the
 819          *      packet.
 820          */
 821         packet = rad_recv(listener->fd, client->message_authenticator);
 822         if (!packet) {
 823                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 824                 DEBUG("%s", fr_strerror());
 825                 return 0;
 826         }
 827
 828         if (!received_request(listener, packet, prequest, client)) {
 829                 RAD_STATS_TYPE_INC(listener, total_packets_dropped);
 830                 RAD_STATS_CLIENT_INC(listener, client, total_packets_dropped);
 831                 rad_free(&packet);
 832                 return 0;
 833         }
 834
 835         *pfun = fun;
 836         return 1;
 837 }
 838
 839
 840 #ifdef WITH_ACCOUNTING
 841 /*
 842  *      Receive packets from an accounting socket
 843  */
 844 static int acct_socket_recv(rad_listen_t *listener,
 845                             RAD_REQUEST_FUNP *pfun, REQUEST **prequest)
 846 {
 847         ssize_t         rcode;
 848         int             code, src_port;
 849         RADIUS_PACKET   *packet;
 850         RAD_REQUEST_FUNP fun = NULL;
 851         RADCLIENT       *client;
 852         fr_ipaddr_t     src_ipaddr;
 853
 854         rcode = rad_recv_header(listener->fd, &src_ipaddr, &src_port, &code);
 855         if (rcode < 0) return 0;
 856
 857         RAD_STATS_TYPE_INC(listener, total_requests);
 858
 859         if (rcode < 20) {       /* AUTH_HDR_LEN */
 860                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 861                 return 0;
 862         }
 863
 864         if ((client = client_listener_find(listener,
 865                                            &src_ipaddr, src_port)) == NULL) {
 866                 rad_recv_discard(listener->fd);
 867                 RAD_STATS_TYPE_INC(listener, total_invalid_requests);
 868                 return 0;
 869         }
 870
 871         /*
 872          *      Some sanity checks, based on the packet code.
 873          */
 874         switch(code) {
 875         case PW_ACCOUNTING_REQUEST:
 876                 RAD_STATS_CLIENT_INC(listener, client, total_requests);
 877                 fun = rad_accounting;
 878                 break;
 879
 880         case PW_STATUS_SERVER:
 881                 if (!mainconfig.status_server) {
 882                         rad_recv_discard(listener->fd);
 883                         RAD_STATS_TYPE_INC(listener, total_packets_dropped);
 884                         RAD_STATS_CLIENT_INC(listener, client, total_unknown_types);
 885
 886                         DEBUG("WARNING: Ignoring Status-Server request due to security configuration");
 887                         return 0;
 888                 }
 889                 fun = rad_status_server;
 890                 break;
 891
 892         default:
 893                 rad_recv_discard(listener->fd);
 894                 RAD_STATS_TYPE_INC(listener, total_unknown_types);
 895                 RAD_STATS_CLIENT_INC(listener, client, total_unknown_types);
 896
 897                 DEBUG("Invalid packet code %d sent to a accounting port from client %s port %d : IGNORED",
 898                       code, client->shortname, src_port);
 899                 return 0;
 900         } /* switch over packet types */
 901
 902         /*
 903          *      Now that we've sanity checked everything, receive the
 904          *      packet.
 905          */
 906         packet = rad_recv(listener->fd, 0);
 907         if (!packet) {
 908                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 909                 radlog(L_ERR, "%s", fr_strerror());
 910                 return 0;
 911         }
 912
 913         /*
 914          *      There can be no duplicate accounting packets.
 915          */
 916         if (!received_request(listener, packet, prequest, client)) {
 917                 RAD_STATS_TYPE_INC(listener, total_packets_dropped);
 918                 RAD_STATS_CLIENT_INC(listener, client, total_packets_dropped);
 919                 rad_free(&packet);
 920                 return 0;
 921         }
 922
 923         *pfun = fun;
 924         return 1;
 925 }
 926 #endif
 927
 928
 929 #ifdef WITH_COA
 930 /*
 931  *      For now, all CoA requests are *only* originated, and not
 932  *      proxied.  So all of the necessary work is done in the
 933  *      post-proxy section, which is automatically handled by event.c.
 934  *      As a result, we don't have to do anything here.
 935  */
 936 static int rad_coa_reply(REQUEST *request)
 937 {
 938         VALUE_PAIR *s1, *s2;
 939
 940         /*
 941          *      Inform the user about RFC requirements.
 942          */
 943         s1 = pairfind(request->proxy->vps, PW_STATE);
 944         if (s1) {
 945                 s2 = pairfind(request->proxy_reply->vps, PW_STATE);
 946
 947                 if (!s2) {
 948                         DEBUG("WARNING: Client was sent State in CoA, and did not respond with State.");
 949
 950                 } else if ((s1->length != s2->length) ||
 951                            (memcmp(s1->vp_octets, s2->vp_octets,
 952                                    s1->length) != 0)) {
 953                         DEBUG("WARNING: Client was sent State in CoA, and did not respond with the same State.");
 954                 }
 955         }
 956
 957         return RLM_MODULE_OK;
 958 }
 959
 960 /*
 961  *      Receive a CoA packet.
 962  */
 963 static int rad_coa_recv(REQUEST *request)
 964 {
 965         int rcode = RLM_MODULE_OK;
 966         int ack, nak;
 967         VALUE_PAIR *vp;
 968
 969         /*
 970          *      Get the correct response
 971          */
 972         switch (request->packet->code) {
 973         case PW_COA_REQUEST:
 974                 ack = PW_COA_ACK;
 975                 nak = PW_COA_NAK;
 976                 break;
 977
 978         case PW_DISCONNECT_REQUEST:
 979                 ack = PW_DISCONNECT_ACK;
 980                 nak = PW_DISCONNECT_NAK;
 981                 break;
 982
 983         default:                /* shouldn't happen */
 984                 return RLM_MODULE_FAIL;
 985         }
 986
 987 #ifdef WITH_PROXY
 988 #define WAS_PROXIED (request->proxy)
 989 #else
 990 #define WAS_PROXIED (0)
 991 #endif
 992
 993         if (!WAS_PROXIED) {
 994                 /*
 995                  *      RFC 5176 Section 3.3.  If we have a CoA-Request
 996                  *      with Service-Type = Authorize-Only, it MUST
 997                  *      have a State attribute in it.
 998                  */
 999                 vp = pairfind(request->packet->vps, PW_SERVICE_TYPE);
1000                 if (request->packet->code == PW_COA_REQUEST) {
1001                         if (vp && (vp->vp_integer == 17)) {
1002                                 vp = pairfind(request->packet->vps, PW_STATE);
1003                                 if (!vp || (vp->length == 0)) {
1004                                         RDEBUG("ERROR: CoA-Request with Service-Type = Authorize-Only MUST contain a State attribute");
1005                                         request->reply->code = PW_COA_NAK;
1006                                         return RLM_MODULE_FAIL;
1007                                 }
1008                         }
1009                 } else if (vp) {
1010                         /*
1011                          *      RFC 5176, Section 3.2.
1012                          */
1013                         RDEBUG("ERROR: Disconnect-Request MUST NOT contain a Service-Type attribute");
1014                         request->reply->code = PW_DISCONNECT_NAK;
1015                         return RLM_MODULE_FAIL;
1016                 }
1017
1018                 rcode = module_recv_coa(0, request);
1019                 switch (rcode) {
1020                 case RLM_MODULE_FAIL:
1021                 case RLM_MODULE_INVALID:
1022                 case RLM_MODULE_REJECT:
1023                 case RLM_MODULE_USERLOCK:
1024                 default:
1025                         request->reply->code = nak;
1026                         break;
1027
1028                 case RLM_MODULE_HANDLED:
1029                         return rcode;
1030
1031                 case RLM_MODULE_NOOP:
1032                 case RLM_MODULE_NOTFOUND:
1033                 case RLM_MODULE_OK:
1034                 case RLM_MODULE_UPDATED:
1035                         request->reply->code = ack;
1036                         break;
1037                 }
1038         } else {
1039                 /*
1040                  *      Start the reply code with the proxy reply
1041                  *      code.
1042                  */
1043                 request->reply->code = request->proxy_reply->code;
1044         }
1045
1046         /*
1047          *      Copy State from the request to the reply.
1048          *      See RFC 5176 Section 3.3.
1049          */
1050         vp = paircopy2(request->packet->vps, PW_STATE);
1051         if (vp) pairadd(&request->reply->vps, vp);
1052
1053         /*
1054          *      We may want to over-ride the reply.
1055          */
1056         rcode = module_send_coa(0, request);
1057         switch (rcode) {
1058                 /*
1059                  *      We need to send CoA-NAK back if Service-Type
1060                  *      is Authorize-Only.  Rely on the user's policy
1061                  *      to do that.  We're not a real NAS, so this
1062                  *      restriction doesn't (ahem) apply to us.
1063                  */
1064                 case RLM_MODULE_FAIL:
1065                 case RLM_MODULE_INVALID:
1066                 case RLM_MODULE_REJECT:
1067                 case RLM_MODULE_USERLOCK:
1068                 default:
1069                         /*
1070                          *      Over-ride an ACK with a NAK
1071                          */
1072                         request->reply->code = nak;
1073                         break;
1074
1075                 case RLM_MODULE_HANDLED:
1076                         return rcode;
1077
1078                 case RLM_MODULE_NOOP:
1079                 case RLM_MODULE_NOTFOUND:
1080                 case RLM_MODULE_OK:
1081                 case RLM_MODULE_UPDATED:
1082                         /*
1083                          *      Do NOT over-ride a previously set value.
1084                          *      Otherwise an "ok" here will re-write a
1085                          *      NAK to an ACK.
1086                          */
1087                         if (request->reply->code == 0) {
1088                                 request->reply->code = ack;
1089                         }
1090                         break;
1091
1092         }
1093
1094         return RLM_MODULE_OK;
1095 }
1096
1097
1098 /*
1099  *      Check if an incoming request is "ok"
1100  *
1101  *      It takes packets, not requests.  It sees if the packet looks
1102  *      OK.  If so, it does a number of sanity checks on it.
1103   */
1104 static int coa_socket_recv(rad_listen_t *listener,
1105                             RAD_REQUEST_FUNP *pfun, REQUEST **prequest)
1106 {
1107         ssize_t         rcode;
1108         int             code, src_port;
1109         RADIUS_PACKET   *packet;
1110         RAD_REQUEST_FUNP fun = NULL;
1111         char            buffer[128];
1112         RADCLIENT       *client;
1113         fr_ipaddr_t     src_ipaddr;
1114
1115         rcode = rad_recv_header(listener->fd, &src_ipaddr, &src_port, &code);
1116         if (rcode < 0) return 0;
1117
1118         RAD_STATS_TYPE_INC(listener, total_requests);
1119
1120         if (rcode < 20) {       /* AUTH_HDR_LEN */
1121                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
1122                 return 0;
1123         }
1124
1125         if ((client = client_listener_find(listener,
1126                                            &src_ipaddr, src_port)) == NULL) {
1127                 rad_recv_discard(listener->fd);
1128                 RAD_STATS_TYPE_INC(listener, total_invalid_requests);
1129
1130                 if (debug_flag > 0) {
1131                         char name[1024];
1132
1133                         listener->print(listener, name, sizeof(name));
1134
1135                         /*
1136                          *      This is debugging rather than logging, so that
1137                          *      DoS attacks don't affect us.
1138                          */
1139                         DEBUG("Ignoring request to %s from unknown client %s port %d",
1140                               name,
1141                               inet_ntop(src_ipaddr.af, &src_ipaddr.ipaddr,
1142                                         buffer, sizeof(buffer)), src_port);
1143                 }
1144
1145                 return 0;
1146         }
1147
1148         /*
1149          *      Some sanity checks, based on the packet code.
1150          */
1151         switch(code) {
1152         case PW_COA_REQUEST:
1153         case PW_DISCONNECT_REQUEST:
1154                 fun = rad_coa_recv;
1155                 break;
1156
1157         default:
1158                 rad_recv_discard(listener->fd);
1159                 DEBUG("Invalid packet code %d sent to coa port from client %s port %d : IGNORED",
1160                       code, client->shortname, src_port);
1161                 return 0;
1162                 break;
1163         } /* switch over packet types */
1164
1165         /*
1166          *      Now that we've sanity checked everything, receive the
1167          *      packet.
1168          */
1169         packet = rad_recv(listener->fd, client->message_authenticator);
1170         if (!packet) {
1171                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
1172                 DEBUG("%s", fr_strerror());
1173                 return 0;
1174         }
1175
1176         if (!received_request(listener, packet, prequest, client)) {
1177                 rad_free(&packet);
1178                 return 0;
1179         }
1180
1181         *pfun = fun;
1182         return 1;
1183 }
1184 #endif
1185
1186 #ifdef WITH_PROXY
1187 /*
1188  *      Recieve packets from a proxy socket.
1189  */
1190 static int proxy_socket_recv(rad_listen_t *listener,
1191                               RAD_REQUEST_FUNP *pfun, REQUEST **prequest)
1192 {
1193         REQUEST         *request;
1194         RADIUS_PACKET   *packet;
1195         RAD_REQUEST_FUNP fun = NULL;
1196         char            buffer[128];
1197
1198         packet = rad_recv(listener->fd, 0);
1199         if (!packet) {
1200                 radlog(L_ERR, "%s", fr_strerror());
1201                 return 0;
1202         }
1203
1204         /*
1205          *      FIXME: Client MIB updates?
1206          */
1207         switch(packet->code) {
1208         case PW_AUTHENTICATION_ACK:
1209         case PW_ACCESS_CHALLENGE:
1210         case PW_AUTHENTICATION_REJECT:
1211                 fun = rad_authenticate;
1212                 break;
1213
1214 #ifdef WITH_ACCOUNTING
1215         case PW_ACCOUNTING_RESPONSE:
1216                 fun = rad_accounting;
1217                 break;
1218 #endif
1219
1220 #ifdef WITH_COA
1221         case PW_DISCONNECT_ACK:
1222         case PW_DISCONNECT_NAK:
1223         case PW_COA_ACK:
1224         case PW_COA_NAK:
1225                 fun = rad_coa_reply;
1226                 break;
1227 #endif
1228
1229         default:
1230                 /*
1231                  *      FIXME: Update MIB for packet types?
1232                  */
1233                 radlog(L_ERR, "Invalid packet code %d sent to a proxy port "
1234                        "from home server %s port %d - ID %d : IGNORED",
1235                        packet->code,
1236                        ip_ntoh(&packet->src_ipaddr, buffer, sizeof(buffer)),
1237                        packet->src_port, packet->id);
1238                 rad_free(&packet);
1239                 return 0;
1240         }
1241
1242         request = received_proxy_response(packet);
1243         if (!request) {
1244                 rad_free(&packet);
1245                 return 0;
1246         }
1247
1248 #ifdef WITH_COA
1249         /*
1250          *      Distinguish proxied CoA requests from ones we
1251          *      originate.
1252          */
1253         if ((fun == rad_coa_reply) &&
1254             (request->packet->code == request->proxy->code)) {
1255                 fun = rad_coa_recv;
1256         }
1257 #endif
1258
1259         rad_assert(fun != NULL);
1260         *pfun = fun;
1261         *prequest = request;
1262
1263         return 1;
1264 }
1265 #endif
1266
1267
1268 static int client_socket_encode(UNUSED rad_listen_t *listener, REQUEST *request)
1269 {
1270         if (!request->reply->code) return 0;
1271
1272         rad_encode(request->reply, request->packet,
1273                    request->client->secret);
1274         rad_sign(request->reply, request->packet,
1275                  request->client->secret);
1276
1277         return 0;
1278 }
1279
1280
1281 static int client_socket_decode(UNUSED rad_listen_t *listener, REQUEST *request)
1282 {
1283         if (rad_verify(request->packet, NULL,
1284                        request->client->secret) < 0) {
1285                 return -1;
1286         }
1287
1288         return rad_decode(request->packet, NULL,
1289                           request->client->secret);
1290 }
1291
1292 #ifdef WITH_PROXY
1293 static int proxy_socket_encode(UNUSED rad_listen_t *listener, REQUEST *request)
1294 {
1295         rad_encode(request->proxy, NULL, request->home_server->secret);
1296         rad_sign(request->proxy, NULL, request->home_server->secret);
1297
1298         return 0;
1299 }
1300
1301
1302 static int proxy_socket_decode(UNUSED rad_listen_t *listener, REQUEST *request)
1303 {
1304         /*
1305          *      rad_verify is run in event.c, received_proxy_response()
1306          */
1307
1308         return rad_decode(request->proxy_reply, request->proxy,
1309                            request->home_server->secret);
1310 }
1311 #endif
1312
1313 #include "dhcpd.c"
1314
1315 #include "command.c"
1316
1317 static const rad_listen_master_t master_listen[RAD_LISTEN_MAX] = {
1318 #ifdef WITH_STATS
1319         { common_socket_parse, NULL,
1320           stats_socket_recv, auth_socket_send,
1321           socket_print, client_socket_encode, client_socket_decode },
1322 #else
1323         /*
1324          *      This always gets defined.
1325          */
1326         { NULL, NULL, NULL, NULL, NULL, NULL, NULL},    /* RAD_LISTEN_NONE */
1327 #endif
1328
1329 #ifdef WITH_PROXY
1330         /* proxying */
1331         { common_socket_parse, NULL,
1332           proxy_socket_recv, proxy_socket_send,
1333           socket_print, proxy_socket_encode, proxy_socket_decode },
1334 #endif
1335
1336         /* authentication */
1337         { common_socket_parse, NULL,
1338           auth_socket_recv, auth_socket_send,
1339           socket_print, client_socket_encode, client_socket_decode },
1340
1341 #ifdef WITH_ACCOUNTING
1342         /* accounting */
1343         { common_socket_parse, NULL,
1344           acct_socket_recv, acct_socket_send,
1345           socket_print, client_socket_encode, client_socket_decode},
1346 #endif
1347
1348 #ifdef WITH_DETAIL
1349         /* detail */
1350         { detail_parse, detail_free,
1351           detail_recv, detail_send,
1352           detail_print, detail_encode, detail_decode },
1353 #endif
1354
1355 #ifdef WITH_VMPS
1356         /* vlan query protocol */
1357         { common_socket_parse, NULL,
1358           vqp_socket_recv, vqp_socket_send,
1359           socket_print, vqp_socket_encode, vqp_socket_decode },
1360 #endif
1361
1362 #ifdef WITH_DHCP
1363         /* dhcp query protocol */
1364         { dhcp_socket_parse, NULL,
1365           dhcp_socket_recv, dhcp_socket_send,
1366           socket_print, dhcp_socket_encode, dhcp_socket_decode },
1367 #endif
1368
1369 #ifdef WITH_COMMAND_SOCKET
1370         /* TCP command socket */
1371         { command_socket_parse, NULL,
1372           command_domain_accept, command_domain_send,
1373           command_socket_print, command_socket_encode, command_socket_decode },
1374 #endif
1375
1376 #ifdef WITH_COA
1377         /* Change of Authorization */
1378         { common_socket_parse, NULL,
1379           coa_socket_recv, auth_socket_send, /* CoA packets are same as auth */
1380           socket_print, client_socket_encode, client_socket_decode },
1381 #endif
1382
1383 };
1384
1385
1386
1387 /*
1388  *      Binds a listener to a socket.
1389  */
1390 static int listen_bind(rad_listen_t *this)
1391 {
1392         int rcode;
1393         struct sockaddr_storage salocal;
1394         socklen_t       salen;
1395         listen_socket_t *sock = this->data;
1396
1397         /*
1398          *      If the port is zero, then it means the appropriate
1399          *      thing from /etc/services.
1400          */
1401         if (sock->port == 0) {
1402                 struct servent  *svp;
1403
1404                 switch (this->type) {
1405                 case RAD_LISTEN_AUTH:
1406                         svp = getservbyname ("radius", "udp");
1407                         if (svp != NULL) {
1408                                 sock->port = ntohs(svp->s_port);
1409                         } else {
1410                                 sock->port = PW_AUTH_UDP_PORT;
1411                         }
1412                         break;
1413
1414 #ifdef WITH_ACCOUNTING
1415                 case RAD_LISTEN_ACCT:
1416                         svp = getservbyname ("radacct", "udp");
1417                         if (svp != NULL) {
1418                                 sock->port = ntohs(svp->s_port);
1419                         } else {
1420                                 sock->port = PW_ACCT_UDP_PORT;
1421                         }
1422                         break;
1423 #endif
1424
1425 #ifdef WITH_PROXY
1426                 case RAD_LISTEN_PROXY:
1427                         sock->port = 0;
1428                         break;
1429 #endif
1430
1431 #ifdef WITH_VMPS
1432                 case RAD_LISTEN_VQP:
1433                         sock->port = 1589;
1434                         break;
1435 #endif
1436
1437 #ifdef WITH_COA
1438                 case RAD_LISTEN_COA:
1439                         sock->port = PW_COA_UDP_PORT;
1440                         break;
1441 #endif
1442
1443                 default:
1444                         radlog(L_ERR, "ERROR: Non-fatal internal sanity check failed in bind.");
1445                         return -1;
1446                 }
1447         }
1448
1449         /*
1450          *      Copy fr_socket() here, as we may need to bind to a device.
1451          */
1452         this->fd = socket(sock->ipaddr.af, SOCK_DGRAM, 0);
1453         if (this->fd < 0) {
1454                 radlog(L_ERR, "Failed opening socket: %s", strerror(errno));
1455                 return -1;
1456         }
1457
1458 #ifdef SO_BINDTODEVICE
1459         /*
1460          *      Bind to a device BEFORE touching IP addresses.
1461          */
1462         if (sock->interface) {
1463                 struct ifreq ifreq;
1464                 strcpy(ifreq.ifr_name, sock->interface);
1465
1466                 fr_suid_up();
1467                 rcode = setsockopt(this->fd, SOL_SOCKET, SO_BINDTODEVICE,
1468                                    (char *)&ifreq, sizeof(ifreq));
1469                 fr_suid_down();
1470                 if (rcode < 0) {
1471                         close(this->fd);
1472                         radlog(L_ERR, "Failed binding to interface %s: %s",
1473                                sock->interface, strerror(errno));
1474                         return -1;
1475                 } /* else it worked. */
1476         }
1477 #endif
1478
1479 #ifdef WITH_UDPFROMTO
1480         /*
1481          *      Initialize udpfromto for all sockets.
1482          */
1483         if (udpfromto_init(this->fd) != 0) {
1484                 close(this->fd);
1485                 return -1;
1486         }
1487 #endif
1488
1489         /*
1490          *      Set up sockaddr stuff.
1491          */
1492         if (!fr_ipaddr2sockaddr(&sock->ipaddr, sock->port, &salocal, &salen)) {
1493                 close(this->fd);
1494                 return -1;
1495         }
1496
1497 #ifdef HAVE_STRUCT_SOCKADDR_IN6
1498         if (sock->ipaddr.af == AF_INET6) {
1499                 /*
1500                  *      Listening on '::' does NOT get you IPv4 to
1501                  *      IPv6 mapping.  You've got to listen on an IPv4
1502                  *      address, too.  This makes the rest of the server
1503                  *      design a little simpler.
1504                  */
1505 #ifdef IPV6_V6ONLY
1506
1507                 if (IN6_IS_ADDR_UNSPECIFIED(&sock->ipaddr.ipaddr.ip6addr)) {
1508                         int on = 1;
1509
1510                         setsockopt(this->fd, IPPROTO_IPV6, IPV6_V6ONLY,
1511                                    (char *)&on, sizeof(on));
1512                 }
1513 #endif /* IPV6_V6ONLY */
1514         }
1515 #endif /* HAVE_STRUCT_SOCKADDR_IN6 */
1516
1517
1518         if (sock->ipaddr.af == AF_INET) {
1519                 UNUSED int flag;
1520
1521 #if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
1522                 /*
1523                  *      Disable PMTU discovery.  On Linux, this
1524                  *      also makes sure that the "don't fragment"
1525                  *      flag is zero.
1526                  */
1527                 flag = IP_PMTUDISC_DONT;
1528                 setsockopt(this->fd, IPPROTO_IP, IP_MTU_DISCOVER,
1529                            &flag, sizeof(flag));
1530 #endif
1531
1532 #if defined(IP_DONTFRAG)
1533                 /*
1534                  *      Ensure that the "don't fragment" flag is zero.
1535                  */
1536                 flag = 0;
1537                 setsockopt(this->fd, IPPROTO_IP, IP_DONTFRAG,
1538                            &flag, sizeof(flag));
1539 #endif
1540         }
1541
1542         /*
1543          *      May be binding to priviledged ports.
1544          */
1545         fr_suid_up();
1546         rcode = bind(this->fd, (struct sockaddr *) &salocal, salen);
1547         fr_suid_down();
1548         if (rcode < 0) {
1549                 char buffer[256];
1550                 close(this->fd);
1551
1552                 this->print(this, buffer, sizeof(buffer));
1553                 radlog(L_ERR, "Failed binding to %s: %s\n",
1554                        buffer, strerror(errno));
1555                 return -1;
1556         }
1557
1558         /*
1559          *      FreeBSD jail issues.  We bind to 0.0.0.0, but the
1560          *      kernel instead binds us to a 1.2.3.4.  If this
1561          *      happens, notice, and remember our real IP.
1562          */
1563         {
1564                 struct sockaddr_storage src;
1565                 socklen_t               sizeof_src = sizeof(src);
1566
1567                 memset(&src, 0, sizeof_src);
1568                 if (getsockname(this->fd, (struct sockaddr *) &src,
1569                                 &sizeof_src) < 0) {
1570                         radlog(L_ERR, "Failed getting socket name: %s",
1571                                strerror(errno));
1572                         return -1;
1573                 }
1574
1575                 if (!fr_sockaddr2ipaddr(&src, sizeof_src,
1576                                         &sock->ipaddr, &sock->port)) {
1577                         radlog(L_ERR, "Socket has unsupported address family");
1578                         return -1;
1579                 }
1580         }
1581
1582 #ifdef O_NONBLOCK
1583         {
1584                 int flags;
1585
1586                 if ((flags = fcntl(this->fd, F_GETFL, NULL)) < 0)  {
1587                         radlog(L_ERR, "Failure getting socket flags: %s)\n",
1588                                strerror(errno));
1589                         return -1;
1590                 }
1591
1592                 flags |= O_NONBLOCK;
1593                 if( fcntl(this->fd, F_SETFL, flags) < 0) {
1594                         radlog(L_ERR, "Failure setting socket flags: %s)\n",
1595                                strerror(errno));
1596                         return -1;
1597                 }
1598         }
1599 #endif
1600
1601         return 0;
1602 }
1603
1604
1605 /*
1606  *      Allocate & initialize a new listener.
1607  */
1608 static rad_listen_t *listen_alloc(RAD_LISTEN_TYPE type)
1609 {
1610         rad_listen_t *this;
1611
1612         this = rad_malloc(sizeof(*this));
1613         memset(this, 0, sizeof(*this));
1614
1615         this->type = type;
1616         this->recv = master_listen[this->type].recv;
1617         this->send = master_listen[this->type].send;
1618         this->print = master_listen[this->type].print;
1619         this->encode = master_listen[this->type].encode;
1620         this->decode = master_listen[this->type].decode;
1621
1622         switch (type) {
1623 #ifdef WITH_STATS
1624         case RAD_LISTEN_NONE:
1625 #endif
1626         case RAD_LISTEN_AUTH:
1627 #ifdef WITH_ACCOUNTING
1628         case RAD_LISTEN_ACCT:
1629 #endif
1630 #ifdef WITH_PROXY
1631         case RAD_LISTEN_PROXY:
1632 #endif
1633 #ifdef WITH_VMPS
1634         case RAD_LISTEN_VQP:
1635 #endif
1636 #ifdef WITH_COA
1637         case RAD_LISTEN_COA:
1638 #endif
1639                 this->data = rad_malloc(sizeof(listen_socket_t));
1640                 memset(this->data, 0, sizeof(listen_socket_t));
1641                 break;
1642
1643 #ifdef WITH_DHCP
1644         case RAD_LISTEN_DHCP:
1645                 this->data = rad_malloc(sizeof(dhcp_socket_t));
1646                 memset(this->data, 0, sizeof(dhcp_socket_t));
1647                 break;
1648 #endif
1649
1650 #ifdef WITH_DETAIL
1651         case RAD_LISTEN_DETAIL:
1652                 this->data = NULL;
1653                 break;
1654 #endif
1655
1656 #ifdef WITH_COMMAND_SOCKET
1657         case RAD_LISTEN_COMMAND:
1658                 this->data = rad_malloc(sizeof(fr_command_socket_t));
1659                 memset(this->data, 0, sizeof(fr_command_socket_t));
1660                 break;
1661 #endif
1662
1663         default:
1664                 rad_assert("Unsupported option!" == NULL);
1665                 break;
1666         }
1667
1668         return this;
1669 }
1670
1671
1672 #ifdef WITH_PROXY
1673 /*
1674  *      Externally visible function for creating a new proxy LISTENER.
1675  *
1676  *      Not thread-safe, but all calls to it are protected by the
1677  *      proxy mutex in event.c
1678  */
1679 rad_listen_t *proxy_new_listener(fr_ipaddr_t *ipaddr, int exists)
1680 {
1681         int last_proxy_port, port;
1682         rad_listen_t *this, *tmp, **last;
1683         listen_socket_t *sock, *old;
1684
1685         /*
1686          *      Find an existing proxy socket to copy.
1687          */
1688         last_proxy_port = 0;
1689         old = NULL;
1690         last = &mainconfig.listen;
1691         for (tmp = mainconfig.listen; tmp != NULL; tmp = tmp->next) {
1692                 /*
1693                  *      Not proxy, ignore it.
1694                  */
1695                 if (tmp->type != RAD_LISTEN_PROXY) continue;
1696
1697                 sock = tmp->data;
1698
1699                 /*
1700                  *      If we were asked to copy a specific one, do
1701                  *      so.  If we're just finding one that already
1702                  *      exists, return a pointer to it.  Otherwise,
1703                  *      create ANOTHER one with the same IP address.
1704                  */
1705                 if ((ipaddr->af != AF_UNSPEC) &&
1706                     (fr_ipaddr_cmp(&sock->ipaddr, ipaddr) != 0)) {
1707                         if (exists) return tmp;
1708                         continue;
1709                 }
1710
1711                 if (sock->port > last_proxy_port) {
1712                         last_proxy_port = sock->port + 1;
1713                 }
1714                 if (!old) old = sock;
1715
1716                 last = &(tmp->next);
1717         }
1718
1719         if (!old) {
1720                 /*
1721                  *      The socket MUST already exist if we're binding
1722                  *      to an address while proxying.
1723                  *
1724                  *      If we're initializing the server, it's OK for the
1725                  *      socket to NOT exist.
1726                  */
1727                 if (!exists) return NULL;
1728
1729                 this = listen_alloc(RAD_LISTEN_PROXY);
1730
1731                 sock = this->data;
1732                 sock->ipaddr = *ipaddr;
1733
1734         } else {
1735                 this = listen_alloc(RAD_LISTEN_PROXY);
1736
1737                 sock = this->data;
1738                 sock->ipaddr = old->ipaddr;
1739         }
1740
1741         /*
1742          *      Keep going until we find an unused port.
1743          */
1744         for (port = last_proxy_port; port < 64000; port++) {
1745                 int rcode;
1746
1747                 sock->port = port;
1748
1749                 rcode = listen_bind(this);
1750                 if (rcode < 0) {
1751                         listen_free(&this);
1752                         return NULL;
1753                 }
1754
1755                 /*
1756                  *      Add the new listener to the list of
1757                  *      listeners.
1758                  */
1759                 *last = this;
1760                 return this;
1761         }
1762
1763         listen_free(&this);
1764         return NULL;
1765 }
1766 #endif
1767
1768 static const FR_NAME_NUMBER listen_compare[] = {
1769 #ifdef WITH_STATS
1770         { "status",     RAD_LISTEN_NONE },
1771 #endif
1772         { "auth",       RAD_LISTEN_AUTH },
1773 #ifdef WITH_ACCOUNTING
1774         { "acct",       RAD_LISTEN_ACCT },
1775 #endif
1776 #ifdef WITH_DETAIL
1777         { "detail",     RAD_LISTEN_DETAIL },
1778 #endif
1779 #ifdef WITH_PROXY
1780         { "proxy",      RAD_LISTEN_PROXY },
1781 #endif
1782 #ifdef WITH_VMPS
1783         { "vmps",       RAD_LISTEN_VQP },
1784 #endif
1785 #ifdef WITH_DHCP
1786         { "dhcp",       RAD_LISTEN_DHCP },
1787 #endif
1788 #ifdef WITH_COMMAND_SOCKET
1789         { "control",    RAD_LISTEN_COMMAND },
1790 #endif
1791 #ifdef WITH_COA
1792         { "coa",        RAD_LISTEN_COA },
1793 #endif
1794         { NULL, 0 },
1795 };
1796
1797
1798 static rad_listen_t *listen_parse(CONF_SECTION *cs, const char *server)
1799 {
1800         int             type, rcode;
1801         char            *listen_type;
1802         rad_listen_t    *this;
1803
1804         listen_type = NULL;
1805
1806         cf_log_info(cs, "listen {");
1807
1808         rcode = cf_item_parse(cs, "type", PW_TYPE_STRING_PTR,
1809                               &listen_type, "");
1810         if (rcode < 0) return NULL;
1811         if (rcode == 1) {
1812                 free(listen_type);
1813                 cf_log_err(cf_sectiontoitem(cs),
1814                            "No type specified in listen section");
1815                 return NULL;
1816         }
1817
1818         type = fr_str2int(listen_compare, listen_type, -1);
1819         if (type < 0) {
1820                 cf_log_err(cf_sectiontoitem(cs),
1821                            "Invalid type \"%s\" in listen section.",
1822                            listen_type);
1823                 free(listen_type);
1824                 return NULL;
1825         }
1826         free(listen_type);
1827
1828         /*
1829          *      Allow listen sections in the default config to
1830          *      refer to a server.
1831          */
1832         if (!server) {
1833                 rcode = cf_item_parse(cs, "virtual_server", PW_TYPE_STRING_PTR,
1834                                       &server, NULL);
1835                 if (rcode == 1) { /* compatiblity with 2.0-pre */
1836                         rcode = cf_item_parse(cs, "server", PW_TYPE_STRING_PTR,
1837                                               &server, NULL);
1838                 }
1839                 if (rcode < 0) return NULL;
1840         }
1841
1842         /*
1843          *      Set up cross-type data.
1844          */
1845         this = listen_alloc(type);
1846         this->server = server;
1847         this->fd = -1;
1848
1849         /*
1850          *      Call per-type parser.
1851          */
1852         if (master_listen[type].parse(cs, this) < 0) {
1853                 listen_free(&this);
1854                 return NULL;
1855         }
1856
1857         cf_log_info(cs, "}");
1858
1859         return this;
1860 }
1861
1862 /*
1863  *      Generate a list of listeners.  Takes an input list of
1864  *      listeners, too, so we don't close sockets with waiting packets.
1865  */
1866 int listen_init(CONF_SECTION *config, rad_listen_t **head)
1867 {
1868         int             override = FALSE;
1869         int             rcode;
1870         CONF_SECTION    *cs = NULL;
1871         rad_listen_t    **last;
1872         rad_listen_t    *this;
1873         fr_ipaddr_t     server_ipaddr;
1874         int             auth_port = 0;
1875 #ifdef WITH_PROXY
1876         int             defined_proxy = 0;
1877 #endif
1878
1879         /*
1880          *      We shouldn't be called with a pre-existing list.
1881          */
1882         rad_assert(head && (*head == NULL));
1883
1884         last = head;
1885         server_ipaddr.af = AF_UNSPEC;
1886
1887         /*
1888          *      If the port is specified on the command-line,
1889          *      it over-rides the configuration file.
1890          *
1891          *      FIXME: If argv[0] == "vmpsd", then don't listen on auth/acct!
1892          */
1893         if (mainconfig.port >= 0) auth_port = mainconfig.port;
1894
1895         /*
1896          *      If the IP address was configured on the command-line,
1897          *      use that as the "bind_address"
1898          */
1899         if (mainconfig.myip.af != AF_UNSPEC) {
1900                 memcpy(&server_ipaddr, &mainconfig.myip,
1901                        sizeof(server_ipaddr));
1902                 override = TRUE;
1903                 goto bind_it;
1904         }
1905
1906         /*
1907          *      Else look for bind_address and/or listen sections.
1908          */
1909         server_ipaddr.ipaddr.ip4addr.s_addr = htonl(INADDR_NONE);
1910         rcode = cf_item_parse(config, "bind_address",
1911                               PW_TYPE_IPADDR,
1912                               &server_ipaddr.ipaddr.ip4addr, NULL);
1913         if (rcode < 0) return -1; /* error parsing it */
1914
1915         if (rcode == 0) { /* successfully parsed IPv4 */
1916                 listen_socket_t *sock;
1917                 server_ipaddr.af = AF_INET;
1918
1919                 radlog(L_INFO, "WARNING: The directive 'bind_adress' is deprecated, and will be removed in future versions of FreeRADIUS. Please edit the configuration files to use the directive 'listen'.");
1920
1921         bind_it:
1922 #ifdef WITH_VMPS
1923                 if (strcmp(progname, "vmpsd") == 0) {
1924                         this = listen_alloc(RAD_LISTEN_VQP);
1925                         if (!auth_port) auth_port = 1589;
1926                 } else
1927 #endif
1928                         this = listen_alloc(RAD_LISTEN_AUTH);
1929
1930                 sock = this->data;
1931
1932                 sock->ipaddr = server_ipaddr;
1933                 sock->port = auth_port;
1934
1935                 sock->clients = clients_parse_section(config);
1936                 if (!sock->clients) {
1937                         cf_log_err(cf_sectiontoitem(config),
1938                                    "Failed to find any clients for this listen section");
1939                         listen_free(&this);
1940                         return -1;
1941                 }
1942
1943                 if (listen_bind(this) < 0) {
1944                         listen_free(head);
1945                         radlog(L_ERR, "There appears to be another RADIUS server running on the authentication port %d", sock->port);
1946                         listen_free(&this);
1947                         return -1;
1948                 }
1949                 auth_port = sock->port; /* may have been updated in listen_bind */
1950                 if (override) {
1951                         cs = cf_section_sub_find_name2(config, "server",
1952                                                        mainconfig.name);
1953                         if (cs) this->server = mainconfig.name;
1954                 }
1955
1956                 *last = this;
1957                 last = &(this->next);
1958
1959 #ifdef WITH_VMPS
1960                 /*
1961                  *      No acct for vmpsd
1962                  */
1963                 if (strcmp(progname, "vmpsd") == 0) goto do_proxy;
1964 #endif
1965
1966 #ifdef WITH_ACCOUNTING
1967                 /*
1968                  *      Open Accounting Socket.
1969                  *
1970                  *      If we haven't already gotten acct_port from
1971                  *      /etc/services, then make it auth_port + 1.
1972                  */
1973                 this = listen_alloc(RAD_LISTEN_ACCT);
1974                 sock = this->data;
1975
1976                 /*
1977                  *      Create the accounting socket.
1978                  *
1979                  *      The accounting port is always the
1980                  *      authentication port + 1
1981                  */
1982                 sock->ipaddr = server_ipaddr;
1983                 sock->port = auth_port + 1;
1984
1985                 sock->clients = clients_parse_section(config);
1986                 if (!sock->clients) {
1987                         cf_log_err(cf_sectiontoitem(config),
1988                                    "Failed to find any clients for this listen section");
1989                         return -1;
1990                 }
1991
1992                 if (listen_bind(this) < 0) {
1993                         listen_free(&this);
1994                         listen_free(head);
1995                         radlog(L_ERR, "There appears to be another RADIUS server running on the accounting port %d", sock->port);
1996                         return -1;
1997                 }
1998
1999                 if (override) {
2000                         cs = cf_section_sub_find_name2(config, "server",
2001                                                        mainconfig.name);
2002                         if (cs) this->server = mainconfig.name;
2003                 }
2004
2005                 *last = this;
2006                 last = &(this->next);
2007 #endif
2008         } else if (mainconfig.port > 0) { /* no bind address, but a port */
2009                 radlog(L_ERR, "The command-line says \"-p %d\", but there is no associated IP address to use",
2010                        mainconfig.port);
2011                 return -1;
2012         }
2013
2014         /*
2015          *      They specified an IP on the command-line, ignore
2016          *      all listen sections except the one in '-n'.
2017          */
2018         if (mainconfig.myip.af != AF_UNSPEC) {
2019                 CONF_SECTION *subcs;
2020                 const char *name2 = cf_section_name2(cs);
2021
2022                 cs = cf_section_sub_find_name2(config, "server",
2023                                                mainconfig.name);
2024                 if (!cs) goto do_proxy;
2025
2026                 /*
2027                  *      Should really abstract this code...
2028                  */
2029                 for (subcs = cf_subsection_find_next(cs, NULL, "listen");
2030                      subcs != NULL;
2031                      subcs = cf_subsection_find_next(cs, subcs, "listen")) {
2032                         this = listen_parse(subcs, name2);
2033                         if (!this) {
2034                                 listen_free(head);
2035                                 return -1;
2036                         }
2037
2038 #ifdef WITH_PROXY
2039                         if (this->type == RAD_LISTEN_PROXY) defined_proxy = 1;
2040 #endif
2041
2042                         *last = this;
2043                         last = &(this->next);
2044                 } /* loop over "listen" directives in server <foo> */
2045
2046                 goto do_proxy;
2047         }
2048
2049         /*
2050          *      Walk through the "listen" sections, if they exist.
2051          */
2052         for (cs = cf_subsection_find_next(config, NULL, "listen");
2053              cs != NULL;
2054              cs = cf_subsection_find_next(config, cs, "listen")) {
2055                 this = listen_parse(cs, NULL);
2056                 if (!this) {
2057                         listen_free(head);
2058                         return -1;
2059                 }
2060
2061 #ifdef WITH_PROXY
2062                 if (this->type == RAD_LISTEN_PROXY) defined_proxy = 1;
2063 #endif
2064
2065                 *last = this;
2066                 last = &(this->next);
2067         }
2068
2069         /*
2070          *      Check virtual servers for "listen" sections, too.
2071          *
2072          *      FIXME: Move to virtual server init?
2073          */
2074         for (cs = cf_subsection_find_next(config, NULL, "server");
2075              cs != NULL;
2076              cs = cf_subsection_find_next(config, cs, "server")) {
2077                 CONF_SECTION *subcs;
2078                 const char *name2 = cf_section_name2(cs);
2079
2080                 for (subcs = cf_subsection_find_next(cs, NULL, "listen");
2081                      subcs != NULL;
2082                      subcs = cf_subsection_find_next(cs, subcs, "listen")) {
2083                         this = listen_parse(subcs, name2);
2084                         if (!this) {
2085                                 listen_free(head);
2086                                 return -1;
2087                         }
2088
2089 #ifdef WITH_PROXY
2090                         if (this->type == RAD_LISTEN_PROXY) {
2091                                 radlog(L_ERR, "Error: listen type \"proxy\" Cannot appear in a virtual server section");
2092                                 listen_free(head);
2093                                 return -1;
2094                         }
2095 #endif
2096
2097                         *last = this;
2098                         last = &(this->next);
2099                 } /* loop over "listen" directives in virtual servers */
2100         } /* loop over virtual servers */
2101
2102         /*
2103          *      If we're proxying requests, open the proxy FD.
2104          *      Otherwise, don't do anything.
2105          */
2106  do_proxy:
2107 #ifdef WITH_PROXY
2108         if (mainconfig.proxy_requests == TRUE) {
2109                 int             port = -1;
2110                 listen_socket_t *sock = NULL;
2111
2112                 /*
2113                  *      No sockets to receive packets, therefore
2114                  *      proxying is pointless.
2115                  */
2116                 if (!*head) return -1;
2117
2118                 if (defined_proxy) goto check_home_servers;
2119
2120                 /*
2121                  *      Find the first authentication port,
2122                  *      and use it
2123                  */
2124                 for (this = *head; this != NULL; this = this->next) {
2125                         if (this->type == RAD_LISTEN_AUTH) {
2126                                 sock = this->data;
2127                                 if (server_ipaddr.af == AF_UNSPEC) {
2128                                         server_ipaddr = sock->ipaddr;
2129                                 }
2130                                 port = sock->port + 2; /* skip acct port */
2131                                 break;
2132                         }
2133 #ifdef WITH_VMPS
2134                         if (this->type == RAD_LISTEN_VQP) {
2135                                 sock = this->data;
2136                                 if (server_ipaddr.af == AF_UNSPEC) {
2137                                         server_ipaddr = sock->ipaddr;
2138                                 }
2139                                 port = sock->port + 1;
2140                                 break;
2141                         }
2142 #endif
2143                 }
2144
2145                 if (port < 0) port = 1024 + (fr_rand() & 0x1ff);
2146
2147                 /*
2148                  *      Address is still unspecified, use IPv4.
2149                  */
2150                 if (server_ipaddr.af == AF_UNSPEC) {
2151                         server_ipaddr.af = AF_INET;
2152                         server_ipaddr.ipaddr.ip4addr.s_addr = htonl(INADDR_ANY);
2153                 }
2154
2155                 this = listen_alloc(RAD_LISTEN_PROXY);
2156                 sock = this->data;
2157
2158                 /*
2159                  *      Create the first proxy socket.
2160                  */
2161                 sock->ipaddr = server_ipaddr;
2162
2163                 /*
2164                  *      Try to find a proxy port (value doesn't matter)
2165                  */
2166                 for (sock->port = port;
2167                      sock->port < 64000;
2168                      sock->port++) {
2169                         if (listen_bind(this) == 0) {
2170                                 *last = this;
2171                                 last = &(this->next); /* just in case */
2172                                 break;
2173                         }
2174                 }
2175
2176                 if (sock->port >= 64000) {
2177                         listen_free(head);
2178                         listen_free(&this);
2179                         radlog(L_ERR, "Failed to open socket for proxying");
2180                         return -1;
2181                 }
2182
2183                 /*
2184                  *      Create *additional* proxy listeners, based
2185                  *      on their src_ipaddr.
2186                  */
2187         check_home_servers:
2188                 if (home_server_create_listeners(*head) != 0) return -1;
2189         }
2190 #endif
2191
2192         return 0;
2193 }
2194
2195 /*
2196  *      Free a linked list of listeners;
2197  */
2198 void listen_free(rad_listen_t **head)
2199 {
2200         rad_listen_t *this;
2201
2202         if (!head || !*head) return;
2203
2204         this = *head;
2205         while (this) {
2206                 rad_listen_t *next = this->next;
2207
2208                 /*
2209                  *      Other code may have eaten the FD.
2210                  */
2211                 if (this->fd >= 0) close(this->fd);
2212
2213                 if (master_listen[this->type].free) {
2214                         master_listen[this->type].free(this);
2215                 }
2216                 free(this->data);
2217                 free(this);
2218
2219                 this = next;
2220         }
2221
2222         *head = NULL;
2223 }
2224
2225 #ifdef WITH_STATS
2226 RADCLIENT_LIST *listener_find_client_list(const fr_ipaddr_t *ipaddr,
2227                                           int port)
2228 {
2229         rad_listen_t *this;
2230
2231         for (this = mainconfig.listen; this != NULL; this = this->next) {
2232                 listen_socket_t *sock;
2233
2234                 if ((this->type != RAD_LISTEN_AUTH) &&
2235                     (this->type != RAD_LISTEN_ACCT)) continue;
2236
2237                 sock = this->data;
2238
2239                 if ((sock->port == port) &&
2240                     (fr_ipaddr_cmp(ipaddr, &sock->ipaddr) == 0)) {
2241                         return sock->clients;
2242                 }
2243         }
2244
2245         return NULL;
2246 }
2247 #endif
2248
2249 rad_listen_t *listener_find_byipaddr(const fr_ipaddr_t *ipaddr, int port)
2250 {
2251         rad_listen_t *this;
2252
2253         for (this = mainconfig.listen; this != NULL; this = this->next) {
2254                 listen_socket_t *sock;
2255
2256                 /*
2257                  *      FIXME: For TCP, ignore the *secondary*
2258                  *      listeners associated with the main socket.
2259                  */
2260                 if ((this->type != RAD_LISTEN_AUTH) &&
2261                     (this->type != RAD_LISTEN_ACCT)) continue;
2262
2263                 sock = this->data;
2264
2265                 if ((sock->port == port) &&
2266                     (fr_ipaddr_cmp(ipaddr, &sock->ipaddr) == 0)) {
2267                         return this;
2268                 }
2269
2270                 if ((sock->port == port) &&
2271                     ((sock->ipaddr.af == AF_INET) &&
2272                      (sock->ipaddr.ipaddr.ip4addr.s_addr == INADDR_ANY))) {
2273                         return this;
2274                 }
2275
2276 #ifdef HAVE_STRUCT_SOCKADDR_IN6
2277                 if ((sock->port == port) &&
2278                     (sock->ipaddr.af == AF_INET6) &&
2279                     (IN6_IS_ADDR_UNSPECIFIED(&sock->ipaddr.ipaddr.ip6addr))) {
2280                         return this;
2281                 }
2282 #endif
2283         }
2284
2285         return NULL;
2286 }