src/main/listen.c

   1 /*
   2  * listen.c     Handle socket stuff
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2005,2006  The FreeRADIUS server project
  21  * Copyright 2005  Alan DeKok <aland@ox.org>
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include <freeradius-devel/radiusd.h>
  28 #include <freeradius-devel/modules.h>
  29 #include <freeradius-devel/rad_assert.h>
  30 #include <freeradius-devel/vqp.h>
  31 #include <freeradius-devel/dhcp.h>
  32
  33 #include <freeradius-devel/vmps.h>
  34 #include <freeradius-devel/detail.h>
  35
  36 #ifdef WITH_UDPFROMTO
  37 #include <freeradius-devel/udpfromto.h>
  38 #endif
  39
  40 #ifdef HAVE_SYS_RESOURCE_H
  41 #include <sys/resource.h>
  42 #endif
  43
  44 #ifdef HAVE_NET_IF_H
  45 #include <net/if.h>
  46 #endif
  47
  48 #ifdef HAVE_FCNTL_H
  49 #include <fcntl.h>
  50 #endif
  51
  52
  53 /*
  54  *      We'll use this below.
  55  */
  56 typedef int (*rad_listen_parse_t)(CONF_SECTION *, rad_listen_t *);
  57 typedef void (*rad_listen_free_t)(rad_listen_t *);
  58
  59 typedef struct rad_listen_master_t {
  60         rad_listen_parse_t      parse;
  61         rad_listen_free_t       free;
  62         rad_listen_recv_t       recv;
  63         rad_listen_send_t       send;
  64         rad_listen_print_t      print;
  65         rad_listen_encode_t     encode;
  66         rad_listen_decode_t     decode;
  67 } rad_listen_master_t;
  68
  69 typedef struct listen_socket_t {
  70         /*
  71          *      For normal sockets.
  72          */
  73         fr_ipaddr_t     ipaddr;
  74         int             port;
  75         const char              *interface;
  76         RADCLIENT_LIST  *clients;
  77 } listen_socket_t;
  78
  79 static rad_listen_t *listen_alloc(RAD_LISTEN_TYPE type);
  80
  81 /*
  82  *      Find a per-socket client.
  83  */
  84 RADCLIENT *client_listener_find(const rad_listen_t *listener,
  85                                 const fr_ipaddr_t *ipaddr, int src_port)
  86 {
  87 #ifdef WITH_DYNAMIC_CLIENTS
  88         int rcode;
  89         REQUEST *request;
  90         RADCLIENT *created;
  91 #endif
  92         time_t now;
  93         RADCLIENT *client;
  94         RADCLIENT_LIST *clients;
  95
  96         rad_assert(listener != NULL);
  97         rad_assert(ipaddr != NULL);
  98
  99         clients = ((listen_socket_t *)listener->data)->clients;
 100
 101         /*
 102          *      This HAS to have been initialized previously.
 103          */
 104         rad_assert(clients != NULL);
 105
 106         client = client_find(clients, ipaddr);
 107         if (!client) {
 108                 static time_t last_printed = 0;
 109                 char name[256], buffer[128];
 110
 111 #ifdef WITH_DYNAMIC_CLIENTS
 112         unknown:                /* used only for dynamic clients */
 113 #endif
 114
 115                 /*
 116                  *      DoS attack quenching, but only in debug mode.
 117                  *      If they're running in debug mode, show them
 118                  *      every packet.
 119                  */
 120                 if (debug_flag == 0) {
 121                         now = time(NULL);
 122                         if (last_printed == now) return NULL;
 123
 124                         last_printed = now;
 125                 }
 126
 127                 listener->print(listener, name, sizeof(name));
 128
 129                 radlog(L_ERR, "Ignoring request to %s from unknown client %s port %d",
 130                        name, inet_ntop(ipaddr->af, &ipaddr->ipaddr,
 131                                        buffer, sizeof(buffer)),
 132                        src_port);
 133                 return NULL;
 134         }
 135
 136 #ifndef WITH_DYNAMIC_CLIENTS
 137         return client;          /* return the found client. */
 138 #else
 139
 140         /*
 141          *      No server defined, and it's not dynamic.  Return it.
 142          */
 143         if (!client->client_server && !client->dynamic) return client;
 144
 145         now = time(NULL);
 146
 147         /*
 148          *      It's a dynamically generated client, check it.
 149          */
 150         if (client->dynamic && (src_port != 0)) {
 151                 /*
 152                  *      Lives forever.  Return it.
 153                  */
 154                 if (client->lifetime == 0) return client;
 155
 156                 /*
 157                  *      Rate-limit the deletion of known clients.
 158                  *      This makes them last a little longer, but
 159                  *      prevents the server from melting down if (say)
 160                  *      10k clients all expire at once.
 161                  */
 162                 if (now == client->last_new_client) return client;
 163
 164                 /*
 165                  *      It's not dead yet.  Return it.
 166                  */
 167                 if ((client->created + client->lifetime) > now) return client;
 168
 169                 /*
 170                  *      This really puts them onto a queue for later
 171                  *      deletion.
 172                  */
 173                 client_delete(clients, client);
 174
 175                 /*
 176                  *      Go find the enclosing network again.
 177                  */
 178                 client = client_find(clients, ipaddr);
 179
 180                 /*
 181                  *      WTF?
 182                  */
 183                 if (!client) goto unknown;
 184                 if (!client->client_server) goto unknown;
 185
 186                 /*
 187                  *      At this point, 'client' is the enclosing
 188                  *      network that configures where dynamic clients
 189                  *      can be defined.
 190                  */
 191                 rad_assert(client->dynamic == 0);
 192
 193         } else if (!client->dynamic && client->rate_limit) {
 194                 /*
 195                  *      The IP is unknown, so we've found an enclosing
 196                  *      network.  Enable DoS protection.  We only
 197                  *      allow one new client per second.  Known
 198                  *      clients aren't subject to this restriction.
 199                  */
 200                 if (now == client->last_new_client) goto unknown;
 201         }
 202
 203         client->last_new_client = now;
 204
 205         request = request_alloc();
 206         if (!request) goto unknown;
 207
 208         request->listener = listener;
 209         request->client = client;
 210         request->packet = rad_recv(listener->fd, 0x02); /* MSG_PEEK */
 211         if (!request->packet) {                         /* badly formed, etc */
 212                 request_free(&request);
 213                 goto unknown;
 214         }
 215         request->reply = rad_alloc_reply(request->packet);
 216         if (!request->reply) {
 217                 request_free(&request);
 218                 goto unknown;
 219         }
 220         request->packet->timestamp = request->timestamp;
 221         request->number = 0;
 222         request->priority = listener->type;
 223         request->server = client->client_server;
 224         request->root = &mainconfig;
 225
 226         /*
 227          *      Run a fake request through the given virtual server.
 228          *      Look for FreeRADIUS-Client-IP-Address
 229          *               FreeRADIUS-Client-Secret
 230          *              ...
 231          *
 232          *      and create the RADCLIENT structure from that.
 233          */
 234         DEBUG("server %s {", request->server);
 235
 236         rcode = module_authorize(0, request);
 237
 238         DEBUG("} # server %s", request->server);
 239
 240         if (rcode != RLM_MODULE_OK) {
 241                 request_free(&request);
 242                 goto unknown;
 243         }
 244
 245         /*
 246          *      If the client was updated by rlm_dynamic_clients,
 247          *      don't create the client from attribute-value pairs.
 248          */
 249         if (request->client == client) {
 250                 created = client_create(clients, request);
 251         } else {
 252                 created = request->client;
 253
 254                 /*
 255                  *      This frees the client if it isn't valid.
 256                  */
 257                 if (!client_validate(clients, client, created)) goto unknown;
 258         }
 259         request_free(&request);
 260
 261         if (!created) goto unknown;
 262
 263         return created;
 264 #endif
 265 }
 266
 267 static int listen_bind(rad_listen_t *this);
 268
 269
 270 /*
 271  *      Process and reply to a server-status request.
 272  *      Like rad_authenticate and rad_accounting this should
 273  *      live in it's own file but it's so small we don't bother.
 274  */
 275 static int rad_status_server(REQUEST *request)
 276 {
 277         int rcode = RLM_MODULE_OK;
 278         DICT_VALUE *dval;
 279
 280         switch (request->listener->type) {
 281 #ifdef WITH_STATS
 282         case RAD_LISTEN_NONE:
 283 #endif
 284         case RAD_LISTEN_AUTH:
 285                 dval = dict_valbyname(PW_AUTZ_TYPE, "Status-Server");
 286                 if (dval) {
 287                         rcode = module_authorize(dval->value, request);
 288                 } else {
 289                         rcode = RLM_MODULE_OK;
 290                 }
 291
 292                 switch (rcode) {
 293                 case RLM_MODULE_OK:
 294                 case RLM_MODULE_UPDATED:
 295                         request->reply->code = PW_AUTHENTICATION_ACK;
 296                         break;
 297
 298                 case RLM_MODULE_FAIL:
 299                 case RLM_MODULE_HANDLED:
 300                         request->reply->code = 0; /* don't reply */
 301                         break;
 302
 303                 default:
 304                 case RLM_MODULE_REJECT:
 305                         request->reply->code = PW_AUTHENTICATION_REJECT;
 306                         break;
 307                 }
 308                 break;
 309
 310 #ifdef WITH_ACCOUNTING
 311         case RAD_LISTEN_ACCT:
 312                 dval = dict_valbyname(PW_ACCT_TYPE, "Status-Server");
 313                 if (dval) {
 314                         rcode = module_accounting(dval->value, request);
 315                 } else {
 316                         rcode = RLM_MODULE_OK;
 317                 }
 318
 319                 switch (rcode) {
 320                 case RLM_MODULE_OK:
 321                 case RLM_MODULE_UPDATED:
 322                         request->reply->code = PW_ACCOUNTING_RESPONSE;
 323                         break;
 324
 325                 default:
 326                         request->reply->code = 0; /* don't reply */
 327                         break;
 328                 }
 329                 break;
 330 #endif
 331
 332 #ifdef WITH_COA
 333                 /*
 334                  *      This is a vendor extension.  Suggested by Glen
 335                  *      Zorn in IETF 72, and rejected by the rest of
 336                  *      the WG.  We like it, so it goes in here.
 337                  */
 338         case RAD_LISTEN_COA:
 339                 dval = dict_valbyname(PW_RECV_COA_TYPE, "Status-Server");
 340                 if (dval) {
 341                         rcode = module_recv_coa(dval->value, request);
 342                 } else {
 343                         rcode = RLM_MODULE_OK;
 344                 }
 345
 346                 switch (rcode) {
 347                 case RLM_MODULE_OK:
 348                 case RLM_MODULE_UPDATED:
 349                         request->reply->code = PW_COA_ACK;
 350                         break;
 351
 352                 default:
 353                         request->reply->code = 0; /* don't reply */
 354                         break;
 355                 }
 356                 break;
 357 #endif
 358
 359         default:
 360                 return 0;
 361         }
 362
 363 #ifdef WITH_STATS
 364         /*
 365          *      Full statistics are available only on a statistics
 366          *      socket.
 367          */
 368         if (request->listener->type == RAD_LISTEN_NONE) {
 369                 request_stats_reply(request);
 370         }
 371 #endif
 372
 373         return 0;
 374 }
 375
 376
 377 static int socket_print(rad_listen_t *this, char *buffer, size_t bufsize)
 378 {
 379         size_t len;
 380         listen_socket_t *sock = this->data;
 381         const char *name;
 382
 383         switch (this->type) {
 384 #ifdef WITH_STATS
 385         case RAD_LISTEN_NONE:   /* what a hack... */
 386                 name = "status";
 387                 break;
 388 #endif
 389
 390         case RAD_LISTEN_AUTH:
 391                 name = "authentication";
 392                 break;
 393
 394 #ifdef WITH_ACCOUNTING
 395         case RAD_LISTEN_ACCT:
 396                 name = "accounting";
 397                 break;
 398 #endif
 399
 400 #ifdef WITH_PROXY
 401         case RAD_LISTEN_PROXY:
 402                 name = "proxy";
 403                 break;
 404 #endif
 405
 406 #ifdef WITH_VMPS
 407         case RAD_LISTEN_VQP:
 408                 name = "vmps";
 409                 break;
 410 #endif
 411
 412 #ifdef WITH_DHCP
 413         case RAD_LISTEN_DHCP:
 414                 name = "dhcp";
 415                 break;
 416 #endif
 417
 418 #ifdef WITH_COA
 419         case RAD_LISTEN_COA:
 420                 name = "coa";
 421                 break;
 422 #endif
 423
 424         default:
 425                 name = "??";
 426                 break;
 427         }
 428
 429 #define FORWARD len = strlen(buffer); if (len >= (bufsize + 1)) return 0;buffer += len;bufsize -= len
 430 #define ADDSTRING(_x) strlcpy(buffer, _x, bufsize);FORWARD
 431
 432         ADDSTRING(name);
 433
 434         if (sock->interface) {
 435                 ADDSTRING(" interface ");
 436                 ADDSTRING(sock->interface);
 437         }
 438
 439         ADDSTRING(" address ");
 440
 441         if ((sock->ipaddr.af == AF_INET) &&
 442             (sock->ipaddr.ipaddr.ip4addr.s_addr == htonl(INADDR_ANY))) {
 443                 strlcpy(buffer, "*", bufsize);
 444         } else {
 445                 ip_ntoh(&sock->ipaddr, buffer, bufsize);
 446         }
 447         FORWARD;
 448
 449         ADDSTRING(" port ");
 450         snprintf(buffer, bufsize, "%d", sock->port);
 451         FORWARD;
 452
 453         if (this->server) {
 454                 ADDSTRING(" as server ");
 455                 ADDSTRING(this->server);
 456         }
 457
 458 #undef ADDSTRING
 459 #undef FORWARD
 460
 461         return 1;
 462 }
 463
 464
 465 /*
 466  *      Parse an authentication or accounting socket.
 467  */
 468 static int common_socket_parse(CONF_SECTION *cs, rad_listen_t *this)
 469 {
 470         int             rcode;
 471         int             listen_port;
 472         fr_ipaddr_t     ipaddr;
 473         listen_socket_t *sock = this->data;
 474         char            *section_name = NULL;
 475         CONF_SECTION    *client_cs, *parentcs;
 476
 477         /*
 478          *      Try IPv4 first
 479          */
 480         ipaddr.ipaddr.ip4addr.s_addr = htonl(INADDR_NONE);
 481         rcode = cf_item_parse(cs, "ipaddr", PW_TYPE_IPADDR,
 482                               &ipaddr.ipaddr.ip4addr, NULL);
 483         if (rcode < 0) return -1;
 484
 485         if (rcode == 0) { /* successfully parsed IPv4 */
 486                 ipaddr.af = AF_INET;
 487
 488         } else {        /* maybe IPv6? */
 489                 rcode = cf_item_parse(cs, "ipv6addr", PW_TYPE_IPV6ADDR,
 490                                       &ipaddr.ipaddr.ip6addr, NULL);
 491                 if (rcode < 0) return -1;
 492
 493                 if (rcode == 1) {
 494                         cf_log_err(cf_sectiontoitem(cs),
 495                                    "No address specified in listen section");
 496                         return -1;
 497                 }
 498                 ipaddr.af = AF_INET6;
 499         }
 500
 501         rcode = cf_item_parse(cs, "port", PW_TYPE_INTEGER,
 502                               &listen_port, "0");
 503         if (rcode < 0) return -1;
 504
 505         if ((listen_port < 0) || (listen_port > 65535)) {
 506                         cf_log_err(cf_sectiontoitem(cs),
 507                                    "Invalid value for \"port\"");
 508                         return -1;
 509         }
 510
 511         sock->ipaddr = ipaddr;
 512         sock->port = listen_port;
 513
 514         /*
 515          *      If we can bind to interfaces, do so,
 516          *      else don't.
 517          */
 518         if (cf_pair_find(cs, "interface")) {
 519                 const char *value;
 520                 CONF_PAIR *cp = cf_pair_find(cs, "interface");
 521
 522                 rad_assert(cp != NULL);
 523                 value = cf_pair_value(cp);
 524                 if (!value) {
 525                         cf_log_err(cf_sectiontoitem(cs),
 526                                    "No interface name given");
 527                         return -1;
 528                 }
 529                 sock->interface = value;
 530         }
 531
 532         /*
 533          *      And bind it to the port.
 534          */
 535         if (listen_bind(this) < 0) {
 536                 char buffer[128];
 537                 cf_log_err(cf_sectiontoitem(cs),
 538                            "Error binding to port for %s port %d",
 539                            ip_ntoh(&sock->ipaddr, buffer, sizeof(buffer)),
 540                            sock->port);
 541                 return -1;
 542         }
 543
 544 #ifdef WITH_PROXY
 545         /*
 546          *      Proxy sockets don't have clients.
 547          */
 548         if (this->type == RAD_LISTEN_PROXY) return 0;
 549 #endif
 550
 551         /*
 552          *      The more specific configurations are preferred to more
 553          *      generic ones.
 554          */
 555         client_cs = NULL;
 556         parentcs = cf_top_section(cs);
 557         rcode = cf_item_parse(cs, "clients", PW_TYPE_STRING_PTR,
 558                               &section_name, NULL);
 559         if (rcode < 0) return -1; /* bad string */
 560         if (rcode == 0) {
 561                 /*
 562                  *      Explicit list given: use it.
 563                  */
 564                 client_cs = cf_section_sub_find_name2(parentcs,
 565                                                       "clients",
 566                                                       section_name);
 567                 if (!client_cs) {
 568                         client_cs = cf_section_find(section_name);
 569                 }
 570                 if (!client_cs) {
 571                         cf_log_err(cf_sectiontoitem(cs),
 572                                    "Failed to find clients %s {...}",
 573                                    section_name);
 574                         free(section_name);
 575                         return -1;
 576                 }
 577                 free(section_name);
 578         } /* else there was no "clients = " entry. */
 579
 580         if (!client_cs) {
 581                 CONF_SECTION *server_cs;
 582
 583                 server_cs = cf_section_sub_find_name2(parentcs,
 584                                                       "server",
 585                                                       this->server);
 586                 /*
 587                  *      Found a "server foo" section.  If there are clients
 588                  *      in it, use them.
 589                  */
 590                 if (server_cs &&
 591                     (cf_section_sub_find(server_cs, "client") != NULL)) {
 592                         client_cs = server_cs;
 593                 }
 594         }
 595
 596         /*
 597          *      Still nothing.  Look for global clients.
 598          */
 599         if (!client_cs) client_cs = parentcs;
 600
 601         sock->clients = clients_parse_section(client_cs);
 602         if (!sock->clients) {
 603                 cf_log_err(cf_sectiontoitem(cs),
 604                            "Failed to load clients for this listen section");
 605                 return -1;
 606         }
 607
 608         return 0;
 609 }
 610
 611 /*
 612  *      Send an authentication response packet
 613  */
 614 static int auth_socket_send(rad_listen_t *listener, REQUEST *request)
 615 {
 616         rad_assert(request->listener == listener);
 617         rad_assert(listener->send == auth_socket_send);
 618
 619         return rad_send(request->reply, request->packet,
 620                         request->client->secret);
 621 }
 622
 623
 624 #ifdef WITH_ACCOUNTING
 625 /*
 626  *      Send an accounting response packet (or not)
 627  */
 628 static int acct_socket_send(rad_listen_t *listener, REQUEST *request)
 629 {
 630         rad_assert(request->listener == listener);
 631         rad_assert(listener->send == acct_socket_send);
 632
 633         /*
 634          *      Accounting reject's are silently dropped.
 635          *
 636          *      We do it here to avoid polluting the rest of the
 637          *      code with this knowledge
 638          */
 639         if (request->reply->code == 0) return 0;
 640
 641         return rad_send(request->reply, request->packet,
 642                         request->client->secret);
 643 }
 644 #endif
 645
 646 #ifdef WITH_PROXY
 647 /*
 648  *      Send a packet to a home server.
 649  *
 650  *      FIXME: have different code for proxy auth & acct!
 651  */
 652 static int proxy_socket_send(rad_listen_t *listener, REQUEST *request)
 653 {
 654         listen_socket_t *sock = listener->data;
 655
 656         rad_assert(request->proxy_listener == listener);
 657         rad_assert(listener->send == proxy_socket_send);
 658
 659         request->proxy->src_ipaddr = sock->ipaddr;
 660         request->proxy->src_port = sock->port;
 661
 662         return rad_send(request->proxy, request->packet,
 663                         request->home_server->secret);
 664 }
 665 #endif
 666
 667 #ifdef WITH_STATS
 668 /*
 669  *      Check if an incoming request is "ok"
 670  *
 671  *      It takes packets, not requests.  It sees if the packet looks
 672  *      OK.  If so, it does a number of sanity checks on it.
 673   */
 674 static int stats_socket_recv(rad_listen_t *listener,
 675                             RAD_REQUEST_FUNP *pfun, REQUEST **prequest)
 676 {
 677         ssize_t         rcode;
 678         int             code, src_port;
 679         RADIUS_PACKET   *packet;
 680         RADCLIENT       *client;
 681         fr_ipaddr_t     src_ipaddr;
 682
 683         rcode = rad_recv_header(listener->fd, &src_ipaddr, &src_port, &code);
 684         if (rcode < 0) return 0;
 685
 686         RAD_STATS_TYPE_INC(listener, total_requests);
 687
 688         if (rcode < 20) {       /* AUTH_HDR_LEN */
 689                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 690                 return 0;
 691         }
 692
 693         if ((client = client_listener_find(listener,
 694                                            &src_ipaddr, src_port)) == NULL) {
 695                 rad_recv_discard(listener->fd);
 696                 RAD_STATS_TYPE_INC(listener, total_invalid_requests);
 697                 return 0;
 698         }
 699
 700         /*
 701          *      We only understand Status-Server on this socket.
 702          */
 703         if (code != PW_STATUS_SERVER) {
 704                 DEBUG("Ignoring packet code %d sent to Status-Server port",
 705                       code);
 706                 rad_recv_discard(listener->fd);
 707                 RAD_STATS_TYPE_INC(listener, total_unknown_types);
 708                 RAD_STATS_CLIENT_INC(listener, client, total_unknown_types);
 709                 return 0;
 710         }
 711
 712         /*
 713          *      Now that we've sanity checked everything, receive the
 714          *      packet.
 715          */
 716         packet = rad_recv(listener->fd, 1); /* require message authenticator */
 717         if (!packet) {
 718                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 719                 DEBUG("%s", fr_strerror());
 720                 return 0;
 721         }
 722
 723         if (!received_request(listener, packet, prequest, client)) {
 724                 RAD_STATS_TYPE_INC(listener, total_packets_dropped);
 725                 RAD_STATS_CLIENT_INC(listener, client, total_packets_dropped);
 726                 rad_free(&packet);
 727                 return 0;
 728         }
 729
 730         *pfun = rad_status_server;
 731         return 1;
 732 }
 733 #endif
 734
 735
 736 /*
 737  *      Check if an incoming request is "ok"
 738  *
 739  *      It takes packets, not requests.  It sees if the packet looks
 740  *      OK.  If so, it does a number of sanity checks on it.
 741   */
 742 static int auth_socket_recv(rad_listen_t *listener,
 743                             RAD_REQUEST_FUNP *pfun, REQUEST **prequest)
 744 {
 745         ssize_t         rcode;
 746         int             code, src_port;
 747         RADIUS_PACKET   *packet;
 748         RAD_REQUEST_FUNP fun = NULL;
 749         RADCLIENT       *client;
 750         fr_ipaddr_t     src_ipaddr;
 751
 752         rcode = rad_recv_header(listener->fd, &src_ipaddr, &src_port, &code);
 753         if (rcode < 0) return 0;
 754
 755         RAD_STATS_TYPE_INC(listener, total_requests);
 756
 757         if (rcode < 20) {       /* AUTH_HDR_LEN */
 758                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 759                 return 0;
 760         }
 761
 762         if ((client = client_listener_find(listener,
 763                                            &src_ipaddr, src_port)) == NULL) {
 764                 rad_recv_discard(listener->fd);
 765                 RAD_STATS_TYPE_INC(listener, total_invalid_requests);
 766                 return 0;
 767         }
 768
 769         /*
 770          *      Some sanity checks, based on the packet code.
 771          */
 772         switch(code) {
 773         case PW_AUTHENTICATION_REQUEST:
 774                 RAD_STATS_CLIENT_INC(listener, client, total_requests);
 775                 fun = rad_authenticate;
 776                 break;
 777
 778         case PW_STATUS_SERVER:
 779                 if (!mainconfig.status_server) {
 780                         rad_recv_discard(listener->fd);
 781                         RAD_STATS_TYPE_INC(listener, total_packets_dropped);
 782                         RAD_STATS_CLIENT_INC(listener, client, total_packets_dropped);
 783                         DEBUG("WARNING: Ignoring Status-Server request due to security configuration");
 784                         return 0;
 785                 }
 786                 fun = rad_status_server;
 787                 break;
 788
 789         default:
 790                 rad_recv_discard(listener->fd);
 791                 RAD_STATS_INC(radius_auth_stats.total_unknown_types);
 792                 RAD_STATS_CLIENT_INC(listener, client, total_unknown_types);
 793
 794                 DEBUG("Invalid packet code %d sent to authentication port from client %s port %d : IGNORED",
 795                       code, client->shortname, src_port);
 796                 return 0;
 797                 break;
 798         } /* switch over packet types */
 799
 800         /*
 801          *      Now that we've sanity checked everything, receive the
 802          *      packet.
 803          */
 804         packet = rad_recv(listener->fd, client->message_authenticator);
 805         if (!packet) {
 806                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 807                 DEBUG("%s", fr_strerror());
 808                 return 0;
 809         }
 810
 811         if (!received_request(listener, packet, prequest, client)) {
 812                 RAD_STATS_TYPE_INC(listener, total_packets_dropped);
 813                 RAD_STATS_CLIENT_INC(listener, client, total_packets_dropped);
 814                 rad_free(&packet);
 815                 return 0;
 816         }
 817
 818         *pfun = fun;
 819         return 1;
 820 }
 821
 822
 823 #ifdef WITH_ACCOUNTING
 824 /*
 825  *      Receive packets from an accounting socket
 826  */
 827 static int acct_socket_recv(rad_listen_t *listener,
 828                             RAD_REQUEST_FUNP *pfun, REQUEST **prequest)
 829 {
 830         ssize_t         rcode;
 831         int             code, src_port;
 832         RADIUS_PACKET   *packet;
 833         RAD_REQUEST_FUNP fun = NULL;
 834         RADCLIENT       *client;
 835         fr_ipaddr_t     src_ipaddr;
 836
 837         rcode = rad_recv_header(listener->fd, &src_ipaddr, &src_port, &code);
 838         if (rcode < 0) return 0;
 839
 840         RAD_STATS_TYPE_INC(listener, total_requests);
 841
 842         if (rcode < 20) {       /* AUTH_HDR_LEN */
 843                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 844                 return 0;
 845         }
 846
 847         if ((client = client_listener_find(listener,
 848                                            &src_ipaddr, src_port)) == NULL) {
 849                 rad_recv_discard(listener->fd);
 850                 RAD_STATS_TYPE_INC(listener, total_invalid_requests);
 851                 return 0;
 852         }
 853
 854         /*
 855          *      Some sanity checks, based on the packet code.
 856          */
 857         switch(code) {
 858         case PW_ACCOUNTING_REQUEST:
 859                 RAD_STATS_CLIENT_INC(listener, client, total_requests);
 860                 fun = rad_accounting;
 861                 break;
 862
 863         case PW_STATUS_SERVER:
 864                 if (!mainconfig.status_server) {
 865                         rad_recv_discard(listener->fd);
 866                         RAD_STATS_TYPE_INC(listener, total_packets_dropped);
 867                         RAD_STATS_CLIENT_INC(listener, client, total_unknown_types);
 868
 869                         DEBUG("WARNING: Ignoring Status-Server request due to security configuration");
 870                         return 0;
 871                 }
 872                 fun = rad_status_server;
 873                 break;
 874
 875         default:
 876                 rad_recv_discard(listener->fd);
 877                 RAD_STATS_TYPE_INC(listener, total_unknown_types);
 878                 RAD_STATS_CLIENT_INC(listener, client, total_unknown_types);
 879
 880                 DEBUG("Invalid packet code %d sent to a accounting port from client %s port %d : IGNORED",
 881                       code, client->shortname, src_port);
 882                 return 0;
 883         } /* switch over packet types */
 884
 885         /*
 886          *      Now that we've sanity checked everything, receive the
 887          *      packet.
 888          */
 889         packet = rad_recv(listener->fd, 0);
 890         if (!packet) {
 891                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 892                 radlog(L_ERR, "%s", fr_strerror());
 893                 return 0;
 894         }
 895
 896         /*
 897          *      There can be no duplicate accounting packets.
 898          */
 899         if (!received_request(listener, packet, prequest, client)) {
 900                 RAD_STATS_TYPE_INC(listener, total_packets_dropped);
 901                 RAD_STATS_CLIENT_INC(listener, client, total_packets_dropped);
 902                 rad_free(&packet);
 903                 return 0;
 904         }
 905
 906         *pfun = fun;
 907         return 1;
 908 }
 909 #endif
 910
 911
 912 #ifdef WITH_COA
 913 /*
 914  *      For now, all CoA requests are *only* originated, and not
 915  *      proxied.  So all of the necessary work is done in the
 916  *      post-proxy section, which is automatically handled by event.c.
 917  *      As a result, we don't have to do anything here.
 918  */
 919 static int rad_coa_reply(REQUEST *request)
 920 {
 921         VALUE_PAIR *s1, *s2;
 922
 923         /*
 924          *      Inform the user about RFC requirements.
 925          */
 926         s1 = pairfind(request->proxy->vps, PW_STATE);
 927         if (s1) {
 928                 s2 = pairfind(request->proxy_reply->vps, PW_STATE);
 929
 930                 if (!s2) {
 931                         DEBUG("WARNING: Client was sent State in CoA, and did not respond with State.");
 932
 933                 } else if ((s1->length != s2->length) ||
 934                            (memcmp(s1->vp_octets, s2->vp_octets,
 935                                    s1->length) != 0)) {
 936                         DEBUG("WARNING: Client was sent State in CoA, and did not respond with the same State.");
 937                 }
 938         }
 939
 940         return RLM_MODULE_OK;
 941 }
 942
 943 /*
 944  *      Receive a CoA packet.
 945  */
 946 static int rad_coa_recv(REQUEST *request)
 947 {
 948         int rcode = RLM_MODULE_OK;
 949         int ack, nak;
 950         VALUE_PAIR *vp;
 951
 952         /*
 953          *      Get the correct response
 954          */
 955         switch (request->packet->code) {
 956         case PW_COA_REQUEST:
 957                 ack = PW_COA_ACK;
 958                 nak = PW_COA_NAK;
 959                 break;
 960
 961         case PW_DISCONNECT_REQUEST:
 962                 ack = PW_DISCONNECT_ACK;
 963                 nak = PW_DISCONNECT_NAK;
 964                 break;
 965
 966         default:                /* shouldn't happen */
 967                 return RLM_MODULE_FAIL;
 968         }
 969
 970 #ifdef WITH_PROXY
 971 #define WAS_PROXIED (request->proxy)
 972 #else
 973 #define WAS_PROXIED (0)
 974 #endif
 975
 976         if (!WAS_PROXIED) {
 977                 /*
 978                  *      RFC 5176 Section 3.3.  If we have a CoA-Request
 979                  *      with Service-Type = Authorize-Only, it MUST
 980                  *      have a State attribute in it.
 981                  */
 982                 vp = pairfind(request->packet->vps, PW_SERVICE_TYPE);
 983                 if (request->packet->code == PW_COA_REQUEST) {
 984                         if (vp && (vp->vp_integer == 17)) {
 985                                 vp = pairfind(request->packet->vps, PW_STATE);
 986                                 if (!vp || (vp->length == 0)) {
 987                                         RDEBUG("ERROR: CoA-Request with Service-Type = Authorize-Only MUST contain a State attribute");
 988                                         request->reply->code = PW_COA_NAK;
 989                                         return RLM_MODULE_FAIL;
 990                                 }
 991                         }
 992                 } else if (vp) {
 993                         /*
 994                          *      RFC 5176, Section 3.2.
 995                          */
 996                         RDEBUG("ERROR: Disconnect-Request MUST NOT contain a Service-Type attribute");
 997                         request->reply->code = PW_DISCONNECT_NAK;
 998                         return RLM_MODULE_FAIL;
 999                 }
1000
1001                 rcode = module_recv_coa(0, request);
1002                 switch (rcode) {
1003                 case RLM_MODULE_FAIL:
1004                 case RLM_MODULE_INVALID:
1005                 case RLM_MODULE_REJECT:
1006                 case RLM_MODULE_USERLOCK:
1007                 default:
1008                         request->reply->code = nak;
1009                         break;
1010
1011                 case RLM_MODULE_HANDLED:
1012                         return rcode;
1013
1014                 case RLM_MODULE_NOOP:
1015                 case RLM_MODULE_NOTFOUND:
1016                 case RLM_MODULE_OK:
1017                 case RLM_MODULE_UPDATED:
1018                         request->reply->code = ack;
1019                         break;
1020                 }
1021         } else {
1022                 /*
1023                  *      Start the reply code with the proxy reply
1024                  *      code.
1025                  */
1026                 request->reply->code = request->proxy_reply->code;
1027         }
1028
1029         /*
1030          *      Copy State from the request to the reply.
1031          *      See RFC 5176 Section 3.3.
1032          */
1033         vp = paircopy2(request->packet->vps, PW_STATE);
1034         if (vp) pairadd(&request->reply->vps, vp);
1035
1036         /*
1037          *      We may want to over-ride the reply.
1038          */
1039         rcode = module_send_coa(0, request);
1040         switch (rcode) {
1041                 /*
1042                  *      We need to send CoA-NAK back if Service-Type
1043                  *      is Authorize-Only.  Rely on the user's policy
1044                  *      to do that.  We're not a real NAS, so this
1045                  *      restriction doesn't (ahem) apply to us.
1046                  */
1047                 case RLM_MODULE_FAIL:
1048                 case RLM_MODULE_INVALID:
1049                 case RLM_MODULE_REJECT:
1050                 case RLM_MODULE_USERLOCK:
1051                 default:
1052                         /*
1053                          *      Over-ride an ACK with a NAK
1054                          */
1055                         request->reply->code = nak;
1056                         break;
1057
1058                 case RLM_MODULE_HANDLED:
1059                         return rcode;
1060
1061                 case RLM_MODULE_NOOP:
1062                 case RLM_MODULE_NOTFOUND:
1063                 case RLM_MODULE_OK:
1064                 case RLM_MODULE_UPDATED:
1065                         /*
1066                          *      Do NOT over-ride a previously set value.
1067                          *      Otherwise an "ok" here will re-write a
1068                          *      NAK to an ACK.
1069                          */
1070                         if (request->reply->code == 0) {
1071                                 request->reply->code = ack;
1072                         }
1073                         break;
1074
1075         }
1076
1077         return RLM_MODULE_OK;
1078 }
1079
1080
1081 /*
1082  *      Check if an incoming request is "ok"
1083  *
1084  *      It takes packets, not requests.  It sees if the packet looks
1085  *      OK.  If so, it does a number of sanity checks on it.
1086   */
1087 static int coa_socket_recv(rad_listen_t *listener,
1088                             RAD_REQUEST_FUNP *pfun, REQUEST **prequest)
1089 {
1090         ssize_t         rcode;
1091         int             code, src_port;
1092         RADIUS_PACKET   *packet;
1093         RAD_REQUEST_FUNP fun = NULL;
1094         char            buffer[128];
1095         RADCLIENT       *client;
1096         fr_ipaddr_t     src_ipaddr;
1097
1098         rcode = rad_recv_header(listener->fd, &src_ipaddr, &src_port, &code);
1099         if (rcode < 0) return 0;
1100
1101         RAD_STATS_TYPE_INC(listener, total_requests);
1102
1103         if (rcode < 20) {       /* AUTH_HDR_LEN */
1104                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
1105                 return 0;
1106         }
1107
1108         if ((client = client_listener_find(listener,
1109                                            &src_ipaddr, src_port)) == NULL) {
1110                 rad_recv_discard(listener->fd);
1111                 RAD_STATS_TYPE_INC(listener, total_invalid_requests);
1112
1113                 if (debug_flag > 0) {
1114                         char name[1024];
1115
1116                         listener->print(listener, name, sizeof(name));
1117
1118                         /*
1119                          *      This is debugging rather than logging, so that
1120                          *      DoS attacks don't affect us.
1121                          */
1122                         DEBUG("Ignoring request to %s from unknown client %s port %d",
1123                               name,
1124                               inet_ntop(src_ipaddr.af, &src_ipaddr.ipaddr,
1125                                         buffer, sizeof(buffer)), src_port);
1126                 }
1127
1128                 return 0;
1129         }
1130
1131         /*
1132          *      Some sanity checks, based on the packet code.
1133          */
1134         switch(code) {
1135         case PW_COA_REQUEST:
1136         case PW_DISCONNECT_REQUEST:
1137                 fun = rad_coa_recv;
1138                 break;
1139
1140         default:
1141                 rad_recv_discard(listener->fd);
1142                 DEBUG("Invalid packet code %d sent to coa port from client %s port %d : IGNORED",
1143                       code, client->shortname, src_port);
1144                 return 0;
1145                 break;
1146         } /* switch over packet types */
1147
1148         /*
1149          *      Now that we've sanity checked everything, receive the
1150          *      packet.
1151          */
1152         packet = rad_recv(listener->fd, client->message_authenticator);
1153         if (!packet) {
1154                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
1155                 DEBUG("%s", fr_strerror());
1156                 return 0;
1157         }
1158
1159         if (!received_request(listener, packet, prequest, client)) {
1160                 rad_free(&packet);
1161                 return 0;
1162         }
1163
1164         *pfun = fun;
1165         return 1;
1166 }
1167 #endif
1168
1169 #ifdef WITH_PROXY
1170 /*
1171  *      Recieve packets from a proxy socket.
1172  */
1173 static int proxy_socket_recv(rad_listen_t *listener,
1174                               RAD_REQUEST_FUNP *pfun, REQUEST **prequest)
1175 {
1176         REQUEST         *request;
1177         RADIUS_PACKET   *packet;
1178         RAD_REQUEST_FUNP fun = NULL;
1179         char            buffer[128];
1180
1181         packet = rad_recv(listener->fd, 0);
1182         if (!packet) {
1183                 radlog(L_ERR, "%s", fr_strerror());
1184                 return 0;
1185         }
1186
1187         /*
1188          *      FIXME: Client MIB updates?
1189          */
1190         switch(packet->code) {
1191         case PW_AUTHENTICATION_ACK:
1192         case PW_ACCESS_CHALLENGE:
1193         case PW_AUTHENTICATION_REJECT:
1194                 fun = rad_authenticate;
1195                 break;
1196
1197 #ifdef WITH_ACCOUNTING
1198         case PW_ACCOUNTING_RESPONSE:
1199                 fun = rad_accounting;
1200                 break;
1201 #endif
1202
1203 #ifdef WITH_COA
1204         case PW_DISCONNECT_ACK:
1205         case PW_DISCONNECT_NAK:
1206         case PW_COA_ACK:
1207         case PW_COA_NAK:
1208                 fun = rad_coa_reply;
1209                 break;
1210 #endif
1211
1212         default:
1213                 /*
1214                  *      FIXME: Update MIB for packet types?
1215                  */
1216                 radlog(L_ERR, "Invalid packet code %d sent to a proxy port "
1217                        "from home server %s port %d - ID %d : IGNORED",
1218                        packet->code,
1219                        ip_ntoh(&packet->src_ipaddr, buffer, sizeof(buffer)),
1220                        packet->src_port, packet->id);
1221                 rad_free(&packet);
1222                 return 0;
1223         }
1224
1225         request = received_proxy_response(packet);
1226         if (!request) {
1227                 rad_free(&packet);
1228                 return 0;
1229         }
1230
1231 #ifdef WITH_COA
1232         /*
1233          *      Distinguish proxied CoA requests from ones we
1234          *      originate.
1235          */
1236         if ((fun == rad_coa_reply) &&
1237             (request->packet->code == request->proxy->code)) {
1238                 fun = rad_coa_recv;
1239         }
1240 #endif
1241
1242         rad_assert(fun != NULL);
1243         *pfun = fun;
1244         *prequest = request;
1245
1246         return 1;
1247 }
1248 #endif
1249
1250
1251 static int client_socket_encode(UNUSED rad_listen_t *listener, REQUEST *request)
1252 {
1253         if (!request->reply->code) return 0;
1254
1255         rad_encode(request->reply, request->packet,
1256                    request->client->secret);
1257         rad_sign(request->reply, request->packet,
1258                  request->client->secret);
1259
1260         return 0;
1261 }
1262
1263
1264 static int client_socket_decode(UNUSED rad_listen_t *listener, REQUEST *request)
1265 {
1266         if (rad_verify(request->packet, NULL,
1267                        request->client->secret) < 0) {
1268                 return -1;
1269         }
1270
1271         return rad_decode(request->packet, NULL,
1272                           request->client->secret);
1273 }
1274
1275 #ifdef WITH_PROXY
1276 static int proxy_socket_encode(UNUSED rad_listen_t *listener, REQUEST *request)
1277 {
1278         rad_encode(request->proxy, NULL, request->home_server->secret);
1279         rad_sign(request->proxy, NULL, request->home_server->secret);
1280
1281         return 0;
1282 }
1283
1284
1285 static int proxy_socket_decode(UNUSED rad_listen_t *listener, REQUEST *request)
1286 {
1287         /*
1288          *      rad_verify is run in event.c, received_proxy_response()
1289          */
1290
1291         return rad_decode(request->proxy_reply, request->proxy,
1292                            request->home_server->secret);
1293 }
1294 #endif
1295
1296 #include "dhcpd.c"
1297
1298 #include "command.c"
1299
1300 static const rad_listen_master_t master_listen[RAD_LISTEN_MAX] = {
1301 #ifdef WITH_STATS
1302         { common_socket_parse, NULL,
1303           stats_socket_recv, auth_socket_send,
1304           socket_print, client_socket_encode, client_socket_decode },
1305 #else
1306         /*
1307          *      This always gets defined.
1308          */
1309         { NULL, NULL, NULL, NULL, NULL, NULL, NULL},    /* RAD_LISTEN_NONE */
1310 #endif
1311
1312 #ifdef WITH_PROXY
1313         /* proxying */
1314         { common_socket_parse, NULL,
1315           proxy_socket_recv, proxy_socket_send,
1316           socket_print, proxy_socket_encode, proxy_socket_decode },
1317 #endif
1318
1319         /* authentication */
1320         { common_socket_parse, NULL,
1321           auth_socket_recv, auth_socket_send,
1322           socket_print, client_socket_encode, client_socket_decode },
1323
1324 #ifdef WITH_ACCOUNTING
1325         /* accounting */
1326         { common_socket_parse, NULL,
1327           acct_socket_recv, acct_socket_send,
1328           socket_print, client_socket_encode, client_socket_decode},
1329 #endif
1330
1331 #ifdef WITH_DETAIL
1332         /* detail */
1333         { detail_parse, detail_free,
1334           detail_recv, detail_send,
1335           detail_print, detail_encode, detail_decode },
1336 #endif
1337
1338 #ifdef WITH_VMPS
1339         /* vlan query protocol */
1340         { common_socket_parse, NULL,
1341           vqp_socket_recv, vqp_socket_send,
1342           socket_print, vqp_socket_encode, vqp_socket_decode },
1343 #endif
1344
1345 #ifdef WITH_DHCP
1346         /* dhcp query protocol */
1347         { dhcp_socket_parse, NULL,
1348           dhcp_socket_recv, dhcp_socket_send,
1349           socket_print, dhcp_socket_encode, dhcp_socket_decode },
1350 #endif
1351
1352 #ifdef WITH_COMMAND_SOCKET
1353         /* TCP command socket */
1354         { command_socket_parse, NULL,
1355           command_domain_accept, command_domain_send,
1356           command_socket_print, command_socket_encode, command_socket_decode },
1357 #endif
1358
1359 #ifdef WITH_COA
1360         /* Change of Authorization */
1361         { common_socket_parse, NULL,
1362           coa_socket_recv, auth_socket_send, /* CoA packets are same as auth */
1363           socket_print, client_socket_encode, client_socket_decode },
1364 #endif
1365
1366 };
1367
1368
1369
1370 /*
1371  *      Binds a listener to a socket.
1372  */
1373 static int listen_bind(rad_listen_t *this)
1374 {
1375         int rcode;
1376         struct sockaddr_storage salocal;
1377         socklen_t       salen;
1378         listen_socket_t *sock = this->data;
1379
1380         /*
1381          *      If the port is zero, then it means the appropriate
1382          *      thing from /etc/services.
1383          */
1384         if (sock->port == 0) {
1385                 struct servent  *svp;
1386
1387                 switch (this->type) {
1388                 case RAD_LISTEN_AUTH:
1389                         svp = getservbyname ("radius", "udp");
1390                         if (svp != NULL) {
1391                                 sock->port = ntohs(svp->s_port);
1392                         } else {
1393                                 sock->port = PW_AUTH_UDP_PORT;
1394                         }
1395                         break;
1396
1397 #ifdef WITH_ACCOUNTING
1398                 case RAD_LISTEN_ACCT:
1399                         svp = getservbyname ("radacct", "udp");
1400                         if (svp != NULL) {
1401                                 sock->port = ntohs(svp->s_port);
1402                         } else {
1403                                 sock->port = PW_ACCT_UDP_PORT;
1404                         }
1405                         break;
1406 #endif
1407
1408 #ifdef WITH_PROXY
1409                 case RAD_LISTEN_PROXY:
1410                         sock->port = 0;
1411                         break;
1412 #endif
1413
1414 #ifdef WITH_VMPS
1415                 case RAD_LISTEN_VQP:
1416                         sock->port = 1589;
1417                         break;
1418 #endif
1419
1420 #ifdef WITH_COA
1421                 case RAD_LISTEN_COA:
1422                         svp = getservbyname ("radius-dynauth", "udp");
1423                         if (svp != NULL) {
1424                                 sock->port = ntohs(svp->s_port);
1425                         } else {
1426                                 sock->port = PW_COA_UDP_PORT;
1427                         }
1428                         break;
1429 #endif
1430
1431                 default:
1432                         radlog(L_ERR, "ERROR: Non-fatal internal sanity check failed in bind.");
1433                         return -1;
1434                 }
1435         }
1436
1437         /*
1438          *      Copy fr_socket() here, as we may need to bind to a device.
1439          */
1440         this->fd = socket(sock->ipaddr.af, SOCK_DGRAM, 0);
1441         if (this->fd < 0) {
1442                 radlog(L_ERR, "Failed opening socket: %s", strerror(errno));
1443                 return -1;
1444         }
1445
1446         /*
1447          *      Bind to a device BEFORE touching IP addresses.
1448          */
1449         if (sock->interface) {
1450 #ifdef SO_BINDTODEVICE
1451                 struct ifreq ifreq;
1452                 strcpy(ifreq.ifr_name, sock->interface);
1453
1454                 fr_suid_up();
1455                 rcode = setsockopt(this->fd, SOL_SOCKET, SO_BINDTODEVICE,
1456                                    (char *)&ifreq, sizeof(ifreq));
1457                 fr_suid_down();
1458                 if (rcode < 0) {
1459                         close(this->fd);
1460                         radlog(L_ERR, "Failed binding to interface %s: %s",
1461                                sock->interface, strerror(errno));
1462                         return -1;
1463                 } /* else it worked. */
1464 #else
1465 #ifdef HAVE_STRUCT_SOCKADDR_IN6
1466 #ifdef HAVE_NET_IF_H
1467                 /*
1468                  *      Odds are that any system supporting "bind to
1469                  *      device" also supports IPv6, so this next bit
1470                  *      isn't necessary.  But it's here for
1471                  *      completeness.
1472                  *
1473                  *      If we're doing IPv6, and the scope hasn't yet
1474                  *      been defined, set the scope to the scope of
1475                  *      the interface.
1476                  */
1477                 if (sock->ipaddr.af == AF_INET6) {
1478                         if (sock->ipaddr.scope == 0) {
1479                                 sock->ipaddr.scope = if_nametoindex(sock->interface);
1480                                 if (sock->ipaddr.scope == 0) {
1481                                         close(this->fd);
1482                                         radlog(L_ERR, "Failed finding interface %s: %s",
1483                                                sock->interface, strerror(errno));
1484                                         return -1;
1485                                 }
1486                         } /* else scope was defined: we're OK. */
1487                 } else
1488 #endif
1489 #endif
1490                                 /*
1491                                  *      IPv4: no link local addresses,
1492                                  *      and no bind to device.
1493                                  */
1494                 {
1495                         close(this->fd);
1496                         radlog(L_ERR, "Failed binding to interface %s: \"bind to device\" is unsupported", sock->interface);
1497                         return -1;
1498                 }
1499 #endif
1500         }
1501
1502 #ifdef WITH_UDPFROMTO
1503         /*
1504          *      Initialize udpfromto for all sockets.
1505          */
1506         if (udpfromto_init(this->fd) != 0) {
1507                 close(this->fd);
1508                 return -1;
1509         }
1510 #endif
1511
1512         /*
1513          *      Set up sockaddr stuff.
1514          */
1515         if (!fr_ipaddr2sockaddr(&sock->ipaddr, sock->port, &salocal, &salen)) {
1516                 close(this->fd);
1517                 return -1;
1518         }
1519
1520 #ifdef HAVE_STRUCT_SOCKADDR_IN6
1521         if (sock->ipaddr.af == AF_INET6) {
1522                 /*
1523                  *      Listening on '::' does NOT get you IPv4 to
1524                  *      IPv6 mapping.  You've got to listen on an IPv4
1525                  *      address, too.  This makes the rest of the server
1526                  *      design a little simpler.
1527                  */
1528 #ifdef IPV6_V6ONLY
1529
1530                 if (IN6_IS_ADDR_UNSPECIFIED(&sock->ipaddr.ipaddr.ip6addr)) {
1531                         int on = 1;
1532
1533                         setsockopt(this->fd, IPPROTO_IPV6, IPV6_V6ONLY,
1534                                    (char *)&on, sizeof(on));
1535                 }
1536 #endif /* IPV6_V6ONLY */
1537         }
1538 #endif /* HAVE_STRUCT_SOCKADDR_IN6 */
1539
1540
1541         if (sock->ipaddr.af == AF_INET) {
1542                 UNUSED int flag;
1543
1544 #if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
1545                 /*
1546                  *      Disable PMTU discovery.  On Linux, this
1547                  *      also makes sure that the "don't fragment"
1548                  *      flag is zero.
1549                  */
1550                 flag = IP_PMTUDISC_DONT;
1551                 setsockopt(this->fd, IPPROTO_IP, IP_MTU_DISCOVER,
1552                            &flag, sizeof(flag));
1553 #endif
1554
1555 #if defined(IP_DONTFRAG)
1556                 /*
1557                  *      Ensure that the "don't fragment" flag is zero.
1558                  */
1559                 flag = 0;
1560                 setsockopt(this->fd, IPPROTO_IP, IP_DONTFRAG,
1561                            &flag, sizeof(flag));
1562 #endif
1563         }
1564
1565         /*
1566          *      May be binding to priviledged ports.
1567          */
1568         fr_suid_up();
1569         rcode = bind(this->fd, (struct sockaddr *) &salocal, salen);
1570         fr_suid_down();
1571         if (rcode < 0) {
1572                 char buffer[256];
1573                 close(this->fd);
1574
1575                 this->print(this, buffer, sizeof(buffer));
1576                 radlog(L_ERR, "Failed binding to %s: %s\n",
1577                        buffer, strerror(errno));
1578                 return -1;
1579         }
1580
1581         /*
1582          *      FreeBSD jail issues.  We bind to 0.0.0.0, but the
1583          *      kernel instead binds us to a 1.2.3.4.  If this
1584          *      happens, notice, and remember our real IP.
1585          */
1586         {
1587                 struct sockaddr_storage src;
1588                 socklen_t               sizeof_src = sizeof(src);
1589
1590                 memset(&src, 0, sizeof_src);
1591                 if (getsockname(this->fd, (struct sockaddr *) &src,
1592                                 &sizeof_src) < 0) {
1593                         radlog(L_ERR, "Failed getting socket name: %s",
1594                                strerror(errno));
1595                         return -1;
1596                 }
1597
1598                 if (!fr_sockaddr2ipaddr(&src, sizeof_src,
1599                                         &sock->ipaddr, &sock->port)) {
1600                         radlog(L_ERR, "Socket has unsupported address family");
1601                         return -1;
1602                 }
1603         }
1604
1605 #ifdef O_NONBLOCK
1606         {
1607                 int flags;
1608
1609                 if ((flags = fcntl(this->fd, F_GETFL, NULL)) < 0)  {
1610                         radlog(L_ERR, "Failure getting socket flags: %s)\n",
1611                                strerror(errno));
1612                         return -1;
1613                 }
1614
1615                 flags |= O_NONBLOCK;
1616                 if( fcntl(this->fd, F_SETFL, flags) < 0) {
1617                         radlog(L_ERR, "Failure setting socket flags: %s)\n",
1618                                strerror(errno));
1619                         return -1;
1620                 }
1621         }
1622 #endif
1623
1624         return 0;
1625 }
1626
1627
1628 /*
1629  *      Allocate & initialize a new listener.
1630  */
1631 static rad_listen_t *listen_alloc(RAD_LISTEN_TYPE type)
1632 {
1633         rad_listen_t *this;
1634
1635         this = rad_malloc(sizeof(*this));
1636         memset(this, 0, sizeof(*this));
1637
1638         this->type = type;
1639         this->recv = master_listen[this->type].recv;
1640         this->send = master_listen[this->type].send;
1641         this->print = master_listen[this->type].print;
1642         this->encode = master_listen[this->type].encode;
1643         this->decode = master_listen[this->type].decode;
1644
1645         switch (type) {
1646 #ifdef WITH_STATS
1647         case RAD_LISTEN_NONE:
1648 #endif
1649         case RAD_LISTEN_AUTH:
1650 #ifdef WITH_ACCOUNTING
1651         case RAD_LISTEN_ACCT:
1652 #endif
1653 #ifdef WITH_PROXY
1654         case RAD_LISTEN_PROXY:
1655 #endif
1656 #ifdef WITH_VMPS
1657         case RAD_LISTEN_VQP:
1658 #endif
1659 #ifdef WITH_COA
1660         case RAD_LISTEN_COA:
1661 #endif
1662                 this->data = rad_malloc(sizeof(listen_socket_t));
1663                 memset(this->data, 0, sizeof(listen_socket_t));
1664                 break;
1665
1666 #ifdef WITH_DHCP
1667         case RAD_LISTEN_DHCP:
1668                 this->data = rad_malloc(sizeof(dhcp_socket_t));
1669                 memset(this->data, 0, sizeof(dhcp_socket_t));
1670                 break;
1671 #endif
1672
1673 #ifdef WITH_DETAIL
1674         case RAD_LISTEN_DETAIL:
1675                 this->data = NULL;
1676                 break;
1677 #endif
1678
1679 #ifdef WITH_COMMAND_SOCKET
1680         case RAD_LISTEN_COMMAND:
1681                 this->data = rad_malloc(sizeof(fr_command_socket_t));
1682                 memset(this->data, 0, sizeof(fr_command_socket_t));
1683                 break;
1684 #endif
1685
1686         default:
1687                 rad_assert("Unsupported option!" == NULL);
1688                 break;
1689         }
1690
1691         return this;
1692 }
1693
1694
1695 #ifdef WITH_PROXY
1696 /*
1697  *      Externally visible function for creating a new proxy LISTENER.
1698  *
1699  *      Not thread-safe, but all calls to it are protected by the
1700  *      proxy mutex in event.c
1701  */
1702 rad_listen_t *proxy_new_listener(fr_ipaddr_t *ipaddr, int exists)
1703 {
1704         rad_listen_t *this, *tmp, **last;
1705         listen_socket_t *sock, *old;
1706
1707         /*
1708          *      Find an existing proxy socket to copy.
1709          */
1710         old = NULL;
1711         last = &mainconfig.listen;
1712         for (tmp = mainconfig.listen; tmp != NULL; tmp = tmp->next) {
1713                 /*
1714                  *      Not proxy, ignore it.
1715                  */
1716                 if (tmp->type != RAD_LISTEN_PROXY) continue;
1717
1718                 sock = tmp->data;
1719
1720                 /*
1721                  *      If we were asked to copy a specific one, do
1722                  *      so.  If we're just finding one that already
1723                  *      exists, return a pointer to it.  Otherwise,
1724                  *      create ANOTHER one with the same IP address.
1725                  */
1726                 if ((ipaddr->af != AF_UNSPEC) &&
1727                     (fr_ipaddr_cmp(&sock->ipaddr, ipaddr) != 0)) {
1728                         if (exists) return tmp;
1729                         continue;
1730                 }
1731
1732                 if (!old) old = sock;
1733
1734                 last = &(tmp->next);
1735         }
1736
1737         this = listen_alloc(RAD_LISTEN_PROXY);
1738         sock = this->data;
1739
1740         if (!old) {
1741                 /*
1742                  *      The socket MUST already exist if we're binding
1743                  *      to an address while proxying.
1744                  *
1745                  *      If we're initializing the server, it's OK for the
1746                  *      socket to NOT exist.
1747                  */
1748                 if (!exists) {
1749                         DEBUG("WARNING: No previous template for proxy socket.  Source IP address may be chosen by the OS");
1750                 }
1751
1752                 if (ipaddr->af != AF_UNSPEC) {
1753                         sock->ipaddr = *ipaddr;
1754                 } else {
1755                         memset(&sock->ipaddr, 0, sizeof(sock->ipaddr));
1756                         sock->ipaddr.af = AF_INET; /* Oh well */
1757                 }
1758         } else {
1759                 sock->ipaddr = old->ipaddr;
1760         }
1761
1762         sock->port = 0;
1763
1764         if (listen_bind(this) >= 0) {
1765                 /*
1766                  *      Add the new listener to the list of
1767                  *      listeners.
1768                  */
1769                 *last = this;
1770                 return this;
1771         }
1772
1773         DEBUG("Failed binding to new proxy socket");
1774         listen_free(&this);
1775         return NULL;
1776 }
1777 #endif
1778
1779 static const FR_NAME_NUMBER listen_compare[] = {
1780 #ifdef WITH_STATS
1781         { "status",     RAD_LISTEN_NONE },
1782 #endif
1783         { "auth",       RAD_LISTEN_AUTH },
1784 #ifdef WITH_ACCOUNTING
1785         { "acct",       RAD_LISTEN_ACCT },
1786 #endif
1787 #ifdef WITH_DETAIL
1788         { "detail",     RAD_LISTEN_DETAIL },
1789 #endif
1790 #ifdef WITH_PROXY
1791         { "proxy",      RAD_LISTEN_PROXY },
1792 #endif
1793 #ifdef WITH_VMPS
1794         { "vmps",       RAD_LISTEN_VQP },
1795 #endif
1796 #ifdef WITH_DHCP
1797         { "dhcp",       RAD_LISTEN_DHCP },
1798 #endif
1799 #ifdef WITH_COMMAND_SOCKET
1800         { "control",    RAD_LISTEN_COMMAND },
1801 #endif
1802 #ifdef WITH_COA
1803         { "coa",        RAD_LISTEN_COA },
1804 #endif
1805         { NULL, 0 },
1806 };
1807
1808
1809 static rad_listen_t *listen_parse(CONF_SECTION *cs, const char *server)
1810 {
1811         int             type, rcode;
1812         char            *listen_type;
1813         rad_listen_t    *this;
1814
1815         listen_type = NULL;
1816
1817         cf_log_info(cs, "listen {");
1818
1819         rcode = cf_item_parse(cs, "type", PW_TYPE_STRING_PTR,
1820                               &listen_type, "");
1821         if (rcode < 0) return NULL;
1822         if (rcode == 1) {
1823                 free(listen_type);
1824                 cf_log_err(cf_sectiontoitem(cs),
1825                            "No type specified in listen section");
1826                 return NULL;
1827         }
1828
1829         type = fr_str2int(listen_compare, listen_type, -1);
1830         if (type < 0) {
1831                 cf_log_err(cf_sectiontoitem(cs),
1832                            "Invalid type \"%s\" in listen section.",
1833                            listen_type);
1834                 free(listen_type);
1835                 return NULL;
1836         }
1837         free(listen_type);
1838
1839         /*
1840          *      Allow listen sections in the default config to
1841          *      refer to a server.
1842          */
1843         if (!server) {
1844                 rcode = cf_item_parse(cs, "virtual_server", PW_TYPE_STRING_PTR,
1845                                       &server, NULL);
1846                 if (rcode == 1) { /* compatiblity with 2.0-pre */
1847                         rcode = cf_item_parse(cs, "server", PW_TYPE_STRING_PTR,
1848                                               &server, NULL);
1849                 }
1850                 if (rcode < 0) return NULL;
1851         }
1852
1853         /*
1854          *      Set up cross-type data.
1855          */
1856         this = listen_alloc(type);
1857         this->server = server;
1858         this->fd = -1;
1859
1860         /*
1861          *      Call per-type parser.
1862          */
1863         if (master_listen[type].parse(cs, this) < 0) {
1864                 listen_free(&this);
1865                 return NULL;
1866         }
1867
1868         cf_log_info(cs, "}");
1869
1870         return this;
1871 }
1872
1873 /*
1874  *      Generate a list of listeners.  Takes an input list of
1875  *      listeners, too, so we don't close sockets with waiting packets.
1876  */
1877 int listen_init(CONF_SECTION *config, rad_listen_t **head)
1878 {
1879         int             override = FALSE;
1880         int             rcode;
1881         CONF_SECTION    *cs = NULL;
1882         rad_listen_t    **last;
1883         rad_listen_t    *this;
1884         fr_ipaddr_t     server_ipaddr;
1885         int             auth_port = 0;
1886 #ifdef WITH_PROXY
1887         int             defined_proxy = 0;
1888 #endif
1889
1890         /*
1891          *      We shouldn't be called with a pre-existing list.
1892          */
1893         rad_assert(head && (*head == NULL));
1894
1895         last = head;
1896         server_ipaddr.af = AF_UNSPEC;
1897
1898         /*
1899          *      If the port is specified on the command-line,
1900          *      it over-rides the configuration file.
1901          *
1902          *      FIXME: If argv[0] == "vmpsd", then don't listen on auth/acct!
1903          */
1904         if (mainconfig.port >= 0) auth_port = mainconfig.port;
1905
1906         /*
1907          *      If the IP address was configured on the command-line,
1908          *      use that as the "bind_address"
1909          */
1910         if (mainconfig.myip.af != AF_UNSPEC) {
1911                 memcpy(&server_ipaddr, &mainconfig.myip,
1912                        sizeof(server_ipaddr));
1913                 override = TRUE;
1914                 goto bind_it;
1915         }
1916
1917         /*
1918          *      Else look for bind_address and/or listen sections.
1919          */
1920         server_ipaddr.ipaddr.ip4addr.s_addr = htonl(INADDR_NONE);
1921         rcode = cf_item_parse(config, "bind_address",
1922                               PW_TYPE_IPADDR,
1923                               &server_ipaddr.ipaddr.ip4addr, NULL);
1924         if (rcode < 0) return -1; /* error parsing it */
1925
1926         if (rcode == 0) { /* successfully parsed IPv4 */
1927                 listen_socket_t *sock;
1928                 server_ipaddr.af = AF_INET;
1929
1930                 radlog(L_INFO, "WARNING: The directive 'bind_address' is deprecated, and will be removed in future versions of FreeRADIUS. Please edit the configuration files to use the directive 'listen'.");
1931
1932         bind_it:
1933 #ifdef WITH_VMPS
1934                 if (strcmp(progname, "vmpsd") == 0) {
1935                         this = listen_alloc(RAD_LISTEN_VQP);
1936                         if (!auth_port) auth_port = 1589;
1937                 } else
1938 #endif
1939                         this = listen_alloc(RAD_LISTEN_AUTH);
1940
1941                 sock = this->data;
1942
1943                 sock->ipaddr = server_ipaddr;
1944                 sock->port = auth_port;
1945
1946                 sock->clients = clients_parse_section(config);
1947                 if (!sock->clients) {
1948                         cf_log_err(cf_sectiontoitem(config),
1949                                    "Failed to find any clients for this listen section");
1950                         listen_free(&this);
1951                         return -1;
1952                 }
1953
1954                 if (listen_bind(this) < 0) {
1955                         listen_free(head);
1956                         radlog(L_ERR, "There appears to be another RADIUS server running on the authentication port %d", sock->port);
1957                         listen_free(&this);
1958                         return -1;
1959                 }
1960                 auth_port = sock->port; /* may have been updated in listen_bind */
1961                 if (override) {
1962                         cs = cf_section_sub_find_name2(config, "server",
1963                                                        mainconfig.name);
1964                         if (cs) this->server = mainconfig.name;
1965                 }
1966
1967                 *last = this;
1968                 last = &(this->next);
1969
1970 #ifdef WITH_VMPS
1971                 /*
1972                  *      No acct for vmpsd
1973                  */
1974                 if (strcmp(progname, "vmpsd") == 0) goto do_proxy;
1975 #endif
1976
1977 #ifdef WITH_ACCOUNTING
1978                 /*
1979                  *      Open Accounting Socket.
1980                  *
1981                  *      If we haven't already gotten acct_port from
1982                  *      /etc/services, then make it auth_port + 1.
1983                  */
1984                 this = listen_alloc(RAD_LISTEN_ACCT);
1985                 sock = this->data;
1986
1987                 /*
1988                  *      Create the accounting socket.
1989                  *
1990                  *      The accounting port is always the
1991                  *      authentication port + 1
1992                  */
1993                 sock->ipaddr = server_ipaddr;
1994                 sock->port = auth_port + 1;
1995
1996                 sock->clients = clients_parse_section(config);
1997                 if (!sock->clients) {
1998                         cf_log_err(cf_sectiontoitem(config),
1999                                    "Failed to find any clients for this listen section");
2000                         return -1;
2001                 }
2002
2003                 if (listen_bind(this) < 0) {
2004                         listen_free(&this);
2005                         listen_free(head);
2006                         radlog(L_ERR, "There appears to be another RADIUS server running on the accounting port %d", sock->port);
2007                         return -1;
2008                 }
2009
2010                 if (override) {
2011                         cs = cf_section_sub_find_name2(config, "server",
2012                                                        mainconfig.name);
2013                         if (cs) this->server = mainconfig.name;
2014                 }
2015
2016                 *last = this;
2017                 last = &(this->next);
2018 #endif
2019         } else if (mainconfig.port > 0) { /* no bind address, but a port */
2020                 radlog(L_ERR, "The command-line says \"-p %d\", but there is no associated IP address to use",
2021                        mainconfig.port);
2022                 return -1;
2023         }
2024
2025         /*
2026          *      They specified an IP on the command-line, ignore
2027          *      all listen sections except the one in '-n'.
2028          */
2029         if (mainconfig.myip.af != AF_UNSPEC) {
2030                 CONF_SECTION *subcs;
2031                 const char *name2 = cf_section_name2(cs);
2032
2033                 cs = cf_section_sub_find_name2(config, "server",
2034                                                mainconfig.name);
2035                 if (!cs) goto do_proxy;
2036
2037                 /*
2038                  *      Should really abstract this code...
2039                  */
2040                 for (subcs = cf_subsection_find_next(cs, NULL, "listen");
2041                      subcs != NULL;
2042                      subcs = cf_subsection_find_next(cs, subcs, "listen")) {
2043                         this = listen_parse(subcs, name2);
2044                         if (!this) {
2045                                 listen_free(head);
2046                                 return -1;
2047                         }
2048
2049 #ifdef WITH_PROXY
2050                         if (this->type == RAD_LISTEN_PROXY) defined_proxy = 1;
2051 #endif
2052
2053                         *last = this;
2054                         last = &(this->next);
2055                 } /* loop over "listen" directives in server <foo> */
2056
2057                 goto do_proxy;
2058         }
2059
2060         /*
2061          *      Walk through the "listen" sections, if they exist.
2062          */
2063         for (cs = cf_subsection_find_next(config, NULL, "listen");
2064              cs != NULL;
2065              cs = cf_subsection_find_next(config, cs, "listen")) {
2066                 this = listen_parse(cs, NULL);
2067                 if (!this) {
2068                         listen_free(head);
2069                         return -1;
2070                 }
2071
2072 #ifdef WITH_PROXY
2073                 if (this->type == RAD_LISTEN_PROXY) defined_proxy = 1;
2074 #endif
2075
2076                 *last = this;
2077                 last = &(this->next);
2078         }
2079
2080         /*
2081          *      Check virtual servers for "listen" sections, too.
2082          *
2083          *      FIXME: Move to virtual server init?
2084          */
2085         for (cs = cf_subsection_find_next(config, NULL, "server");
2086              cs != NULL;
2087              cs = cf_subsection_find_next(config, cs, "server")) {
2088                 CONF_SECTION *subcs;
2089                 const char *name2 = cf_section_name2(cs);
2090
2091                 for (subcs = cf_subsection_find_next(cs, NULL, "listen");
2092                      subcs != NULL;
2093                      subcs = cf_subsection_find_next(cs, subcs, "listen")) {
2094                         this = listen_parse(subcs, name2);
2095                         if (!this) {
2096                                 listen_free(head);
2097                                 return -1;
2098                         }
2099
2100 #ifdef WITH_PROXY
2101                         if (this->type == RAD_LISTEN_PROXY) {
2102                                 radlog(L_ERR, "Error: listen type \"proxy\" Cannot appear in a virtual server section");
2103                                 listen_free(head);
2104                                 return -1;
2105                         }
2106 #endif
2107
2108                         *last = this;
2109                         last = &(this->next);
2110                 } /* loop over "listen" directives in virtual servers */
2111         } /* loop over virtual servers */
2112
2113         /*
2114          *      If we're proxying requests, open the proxy FD.
2115          *      Otherwise, don't do anything.
2116          */
2117  do_proxy:
2118 #ifdef WITH_PROXY
2119         if (mainconfig.proxy_requests == TRUE) {
2120                 int             port = -1;
2121                 listen_socket_t *sock = NULL;
2122
2123                 /*
2124                  *      No sockets to receive packets, therefore
2125                  *      proxying is pointless.
2126                  */
2127                 if (!*head) return -1;
2128
2129                 if (defined_proxy) goto check_home_servers;
2130
2131                 /*
2132                  *      Find the first authentication port,
2133                  *      and use it
2134                  */
2135                 for (this = *head; this != NULL; this = this->next) {
2136                         if (this->type == RAD_LISTEN_AUTH) {
2137                                 sock = this->data;
2138                                 if (server_ipaddr.af == AF_UNSPEC) {
2139                                         server_ipaddr = sock->ipaddr;
2140                                 }
2141                                 port = sock->port + 2; /* skip acct port */
2142                                 break;
2143                         }
2144 #ifdef WITH_VMPS
2145                         if (this->type == RAD_LISTEN_VQP) {
2146                                 sock = this->data;
2147                                 if (server_ipaddr.af == AF_UNSPEC) {
2148                                         server_ipaddr = sock->ipaddr;
2149                                 }
2150                                 port = sock->port + 1;
2151                                 break;
2152                         }
2153 #endif
2154                 }
2155
2156                 if (port < 0) port = 1024 + (fr_rand() & 0x1ff);
2157
2158                 /*
2159                  *      Address is still unspecified, use IPv4.
2160                  */
2161                 if (server_ipaddr.af == AF_UNSPEC) {
2162                         server_ipaddr.af = AF_INET;
2163                         server_ipaddr.ipaddr.ip4addr.s_addr = htonl(INADDR_ANY);
2164                 }
2165
2166                 this = listen_alloc(RAD_LISTEN_PROXY);
2167                 sock = this->data;
2168
2169                 /*
2170                  *      Create the first proxy socket.
2171                  */
2172                 sock->ipaddr = server_ipaddr;
2173
2174                 /*
2175                  *      Try to find a proxy port (value doesn't matter)
2176                  */
2177                 for (sock->port = port;
2178                      sock->port < 64000;
2179                      sock->port++) {
2180                         if (listen_bind(this) == 0) {
2181                                 *last = this;
2182                                 last = &(this->next); /* just in case */
2183                                 break;
2184                         }
2185                 }
2186
2187                 if (sock->port >= 64000) {
2188                         listen_free(head);
2189                         listen_free(&this);
2190                         radlog(L_ERR, "Failed to open socket for proxying");
2191                         return -1;
2192                 }
2193
2194                 /*
2195                  *      Create *additional* proxy listeners, based
2196                  *      on their src_ipaddr.
2197                  */
2198         check_home_servers:
2199                 if (home_server_create_listeners(*head) != 0) return -1;
2200         }
2201 #endif
2202
2203         return 0;
2204 }
2205
2206 /*
2207  *      Free a linked list of listeners;
2208  */
2209 void listen_free(rad_listen_t **head)
2210 {
2211         rad_listen_t *this;
2212
2213         if (!head || !*head) return;
2214
2215         this = *head;
2216         while (this) {
2217                 rad_listen_t *next = this->next;
2218
2219                 /*
2220                  *      Other code may have eaten the FD.
2221                  */
2222                 if (this->fd >= 0) close(this->fd);
2223
2224                 if (master_listen[this->type].free) {
2225                         master_listen[this->type].free(this);
2226                 }
2227                 free(this->data);
2228                 free(this);
2229
2230                 this = next;
2231         }
2232
2233         *head = NULL;
2234 }
2235
2236 #ifdef WITH_STATS
2237 RADCLIENT_LIST *listener_find_client_list(const fr_ipaddr_t *ipaddr,
2238                                           int port)
2239 {
2240         rad_listen_t *this;
2241
2242         for (this = mainconfig.listen; this != NULL; this = this->next) {
2243                 listen_socket_t *sock;
2244
2245                 if ((this->type != RAD_LISTEN_AUTH) &&
2246                     (this->type != RAD_LISTEN_ACCT)) continue;
2247
2248                 sock = this->data;
2249
2250                 if ((sock->port == port) &&
2251                     (fr_ipaddr_cmp(ipaddr, &sock->ipaddr) == 0)) {
2252                         return sock->clients;
2253                 }
2254         }
2255
2256         return NULL;
2257 }
2258 #endif
2259
2260 rad_listen_t *listener_find_byipaddr(const fr_ipaddr_t *ipaddr, int port)
2261 {
2262         rad_listen_t *this;
2263
2264         for (this = mainconfig.listen; this != NULL; this = this->next) {
2265                 listen_socket_t *sock;
2266
2267                 /*
2268                  *      FIXME: For TCP, ignore the *secondary*
2269                  *      listeners associated with the main socket.
2270                  */
2271                 if ((this->type != RAD_LISTEN_AUTH) &&
2272                     (this->type != RAD_LISTEN_ACCT)) continue;
2273
2274                 sock = this->data;
2275
2276                 if ((sock->port == port) &&
2277                     (fr_ipaddr_cmp(ipaddr, &sock->ipaddr) == 0)) {
2278                         return this;
2279                 }
2280
2281                 if ((sock->port == port) &&
2282                     ((sock->ipaddr.af == AF_INET) &&
2283                      (sock->ipaddr.ipaddr.ip4addr.s_addr == INADDR_ANY))) {
2284                         return this;
2285                 }
2286
2287 #ifdef HAVE_STRUCT_SOCKADDR_IN6
2288                 if ((sock->port == port) &&
2289                     (sock->ipaddr.af == AF_INET6) &&
2290                     (IN6_IS_ADDR_UNSPECIFIED(&sock->ipaddr.ipaddr.ip6addr))) {
2291                         return this;
2292                 }
2293 #endif
2294         }
2295
2296         return NULL;
2297 }