src/main/realms.c

   1 /*
   2  * realms.c     Realm handling code
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2007  The FreeRADIUS server project
  21  * Copyright 2007  Alan DeKok <aland@deployingradius.com>
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include <freeradius-devel/radiusd.h>
  28 #include <freeradius-devel/rad_assert.h>
  29
  30 #include <sys/stat.h>
  31
  32 #include <ctype.h>
  33 #include <fcntl.h>
  34
  35 static rbtree_t *realms_byname = NULL;
  36
  37 static rbtree_t *home_servers_byaddr = NULL;
  38 static rbtree_t *home_servers_byname = NULL;
  39
  40 static rbtree_t *home_pools_byname = NULL;
  41
  42 static int realm_name_cmp(const void *one, const void *two)
  43 {
  44         const REALM *a = one;
  45         const REALM *b = two;
  46
  47         return strcasecmp(a->name, b->name);
  48 }
  49
  50
  51 static int home_server_name_cmp(const void *one, const void *two)
  52 {
  53         const home_server *a = one;
  54         const home_server *b = two;
  55
  56         if (a->type < b->type) return -1;
  57         if (a->type > b->type) return +1;
  58
  59         return strcasecmp(a->name, b->name);
  60 }
  61
  62 static int home_server_addr_cmp(const void *one, const void *two)
  63 {
  64         const home_server *a = one;
  65         const home_server *b = two;
  66
  67         if (a->port < b->port) return -1;
  68         if (a->port > b->port) return +1;
  69
  70         return lrad_ipaddr_cmp(&a->ipaddr, &b->ipaddr);
  71 }
  72
  73
  74 static int home_pool_name_cmp(const void *one, const void *two)
  75 {
  76         const home_pool_t *a = one;
  77         const home_pool_t *b = two;
  78
  79         if (a->server_type < b->server_type) return -1;
  80         if (a->server_type > b->server_type) return +1;
  81
  82         return strcasecmp(a->name, b->name);
  83 }
  84
  85
  86 void realms_free(void)
  87 {
  88         rbtree_free(home_servers_byname);
  89         home_servers_byname = NULL;
  90
  91         rbtree_free(home_servers_byaddr);
  92         home_servers_byaddr = NULL;
  93
  94         rbtree_free(home_pools_byname);
  95         home_pools_byname = NULL;
  96
  97         rbtree_free(realms_byname);
  98         realms_byname = NULL;
  99 }
 100
 101
 102 int realms_init(const char *filename)
 103 {
 104         CONF_SECTION *cs;
 105
 106         if (realms_byname) return 1;
 107
 108         realms_byname = rbtree_create(realm_name_cmp, free, 0);
 109         if (!realms_byname) {
 110                 realms_free();
 111                 return 0;
 112         }
 113
 114         home_servers_byaddr = rbtree_create(home_server_addr_cmp, free, 0);
 115         if (!home_servers_byaddr) {
 116                 realms_free();
 117                 return 0;
 118         }
 119
 120         home_servers_byname = rbtree_create(home_server_name_cmp, NULL, 0);
 121         if (!home_servers_byname) {
 122                 realms_free();
 123                 return 0;
 124         }
 125
 126         home_pools_byname = rbtree_create(home_pool_name_cmp, free, 0);
 127         if (!home_pools_byname) {
 128                 realms_free();
 129                 return 0;
 130         }
 131
 132         for (cs = cf_subsection_find_next(mainconfig.config, NULL, "realm");
 133              cs != NULL;
 134              cs = cf_subsection_find_next(mainconfig.config, cs, "realm")) {
 135                 if (!realm_add(filename, cs)) {
 136                         realms_free();
 137                         return 0;
 138                 }
 139         }
 140
 141         return 1;
 142 }
 143
 144 static struct in_addr hs_ip4addr;
 145 static struct in6_addr hs_ip6addr;
 146 static char *hs_type = NULL;
 147 static char *hs_check = NULL;
 148
 149 static CONF_PARSER home_server_config[] = {
 150         { "ipaddr",  PW_TYPE_IPADDR,
 151           0, &hs_ip4addr,  NULL },
 152         { "ipv6addr",  PW_TYPE_IPV6ADDR,
 153           0, &hs_ip6addr, NULL },
 154
 155         { "hostname",  PW_TYPE_STRING_PTR,
 156           offsetof(home_server,hostname), NULL,  NULL},
 157         { "port", PW_TYPE_INTEGER,
 158           offsetof(home_server,port), NULL,   "0" },
 159
 160         { "type",  PW_TYPE_STRING_PTR,
 161           0, &hs_type, NULL },
 162
 163         { "secret",  PW_TYPE_STRING_PTR,
 164           offsetof(home_server,secret), NULL,  NULL},
 165
 166         { "response_window", PW_TYPE_INTEGER,
 167           offsetof(home_server,response_window), NULL,   "30" },
 168         { "max_outstanding", PW_TYPE_INTEGER,
 169           offsetof(home_server,max_outstanding), NULL,   "65536" },
 170
 171         { "zombie_period", PW_TYPE_INTEGER,
 172           offsetof(home_server,zombie_period), NULL,   "40" },
 173         { "status_check", PW_TYPE_STRING_PTR,
 174           0, &hs_check,   "none" },
 175         { "ping_check", PW_TYPE_STRING_PTR,
 176           0, &hs_check,   "none" },
 177
 178         { "ping_interval", PW_TYPE_INTEGER,
 179           offsetof(home_server,ping_interval), NULL,   "30" },
 180         { "check_interval", PW_TYPE_INTEGER,
 181           offsetof(home_server,ping_interval), NULL,   "30" },
 182         { "num_answers_to_alive", PW_TYPE_INTEGER,
 183           offsetof(home_server,num_pings_to_alive), NULL,   "3" },
 184         { "num_pings_to_alive", PW_TYPE_INTEGER,
 185           offsetof(home_server,num_pings_to_alive), NULL,   "3" },
 186         { "revive_interval", PW_TYPE_INTEGER,
 187           offsetof(home_server,revive_interval), NULL,   "300" },
 188         { "status_check_timeout", PW_TYPE_INTEGER,
 189           offsetof(home_server,ping_timeout), NULL,   "4" },
 190
 191         { "username",  PW_TYPE_STRING_PTR,
 192           offsetof(home_server,ping_user_name), NULL,  NULL},
 193         { "password",  PW_TYPE_STRING_PTR,
 194           offsetof(home_server,ping_user_password), NULL,  NULL},
 195
 196         { NULL, -1, 0, NULL, NULL }             /* end the list */
 197
 198 };
 199
 200
 201 static int home_server_add(const char *filename, CONF_SECTION *cs)
 202 {
 203         const char *name2;
 204         home_server *home;
 205
 206         name2 = cf_section_name1(cs);
 207         if (!name2 || (strcasecmp(name2, "home_server") != 0)) {
 208                 radlog(L_ERR, "%s[%d]: Section is not a home_server.",
 209                        filename, cf_section_lineno(cs));
 210                 return 0;
 211         }
 212
 213         name2 = cf_section_name2(cs);
 214         if (!name2) {
 215                 radlog(L_ERR, "%s[%d]: Home server section is missing a name.",
 216                        filename, cf_section_lineno(cs));
 217                 return 0;
 218         }
 219
 220         home = rad_malloc(sizeof(*home));
 221         memset(home, 0, sizeof(*home));
 222
 223         home->name = name2;
 224
 225         memset(&hs_ip4addr, 0, sizeof(hs_ip4addr));
 226         memset(&hs_ip6addr, 0, sizeof(hs_ip6addr));
 227         cf_section_parse(cs, home, home_server_config);
 228
 229         if (!home->hostname && (htonl(hs_ip4addr.s_addr) == INADDR_NONE) &&
 230             IN6_IS_ADDR_UNSPECIFIED(&hs_ip6addr)) {
 231                 radlog(L_ERR, "%s[%d]: No hostname, IPv4 address, or IPv6 address defined for home server %s.",
 232                        filename, cf_section_lineno(cs), name2);
 233                 free(home);
 234                 free(hs_type);
 235                 hs_type = NULL;
 236                 free(hs_check);
 237                 hs_check = NULL;
 238                 return 0;
 239         }
 240
 241         /*
 242          *      FIXME: Parse home->hostname!
 243          *
 244          *      Right now, only ipaddr && ip6addr are used.
 245          *      The old-style parsing still allows hostnames.
 246          */
 247         if (htonl(hs_ip4addr.s_addr) != INADDR_NONE) {
 248                 home->ipaddr.af = AF_INET;
 249                 home->ipaddr.ipaddr.ip4addr = hs_ip4addr;
 250
 251         } else if (!IN6_IS_ADDR_UNSPECIFIED(&hs_ip6addr)) {
 252                 home->ipaddr.af = AF_INET6;
 253                 home->ipaddr.ipaddr.ip6addr = hs_ip6addr;
 254
 255         } else {
 256                 radlog(L_ERR, "%s[%d]: FIXME: parse hostname for home server %s.",
 257                        filename, cf_section_lineno(cs), name2);
 258                 free(home);
 259                 free(hs_type);
 260                 hs_type = NULL;
 261                 free(hs_check);
 262                 hs_check = NULL;
 263                 return 0;
 264         }
 265
 266         if (!home->port || (home->port > 65535)) {
 267                 radlog(L_ERR, "%s[%d]: No port, or invalid port defined for home server %s.",
 268                        filename, cf_section_lineno(cs), name2);
 269                 free(home);
 270                 free(hs_type);
 271                 hs_type = NULL;
 272                 free(hs_check);
 273                 hs_check = NULL;
 274                 return 0;
 275         }
 276
 277         if (0) {
 278                 radlog(L_ERR, "%s[%d]: Fatal error!  Home server %s is ourselves!",
 279                        filename, cf_section_lineno(cs), name2);
 280                 free(home);
 281                 free(hs_type);
 282                 hs_type = NULL;
 283                 free(hs_check);
 284                 hs_check = NULL;
 285                 return 0;
 286         }
 287
 288         if (strcasecmp(hs_type, "auth") == 0) {
 289                 home->type = HOME_TYPE_AUTH;
 290
 291         } else if (strcasecmp(hs_type, "acct") == 0) {
 292                 home->type = HOME_TYPE_ACCT;
 293
 294         } else {
 295                 radlog(L_ERR, "%s[%d]: Invalid type \"%s\" for home server %s.",
 296                        filename, cf_section_lineno(cs), hs_type, name2);
 297                 free(home);
 298                 free(hs_type);
 299                 hs_type = NULL;
 300                 free(hs_check);
 301                 hs_check = NULL;
 302                 return 0;
 303         }
 304         free(hs_type);
 305         hs_type = NULL;
 306
 307         if (!home->secret) {
 308                 radlog(L_ERR, "%s[%d]: No shared secret defined for home server %s.",
 309                        filename, cf_section_lineno(cs), name2);
 310                 free(home);
 311                 return 0;
 312         }
 313
 314         if (strcasecmp(hs_check, "none") == 0) {
 315                 home->ping_check = HOME_PING_CHECK_NONE;
 316
 317         } else if (strcasecmp(hs_check, "status-server") == 0) {
 318                 home->ping_check = HOME_PING_CHECK_STATUS_SERVER;
 319
 320         } else if (strcasecmp(hs_check, "request") == 0) {
 321                 home->ping_check = HOME_PING_CHECK_REQUEST;
 322
 323         } else {
 324                 radlog(L_ERR, "%s[%d]: Invalid ping_check \"%s\" for home server %s.",
 325                        filename, cf_section_lineno(cs), hs_check, name2);
 326                 free(home);
 327                 free(hs_check);
 328                 hs_check = NULL;
 329                 return 0;
 330         }
 331         free(hs_check);
 332         hs_check = NULL;
 333
 334         if ((home->ping_check != HOME_PING_CHECK_NONE) &&
 335             (home->ping_check != HOME_PING_CHECK_STATUS_SERVER)) {
 336                 if (!home->ping_user_name) {
 337                         radlog(L_INFO, "%s[%d]: You must supply a user name to enable ping checks",
 338                                filename, cf_section_lineno(cs));
 339                         free(home);
 340                         return 0;
 341                 }
 342
 343                 if ((home->type == HOME_TYPE_AUTH) &&
 344                     !home->ping_user_password) {
 345                         radlog(L_INFO, "%s[%d]: You must supply a password to enable ping checks",
 346                                filename, cf_section_lineno(cs));
 347                         free(home);
 348                         return 0;
 349                 }
 350         }
 351
 352         if (rbtree_finddata(home_servers_byaddr, home)) {
 353                 radlog(L_INFO, "%s[%d]: Ignoring duplicate home server %s.",
 354                        filename, cf_section_lineno(cs), name2);
 355                 return 1;
 356         }
 357
 358         if (!rbtree_insert(home_servers_byname, home)) {
 359                 radlog(L_ERR, "%s[%d]: Internal error adding home server %s.",
 360                        filename, cf_section_lineno(cs), name2);
 361                 free(home);
 362                 return 0;
 363         }
 364
 365         if (!rbtree_insert(home_servers_byaddr, home)) {
 366                 rbtree_deletebydata(home_servers_byname, home);
 367                 radlog(L_ERR, "%s[%d]: Internal error adding home server %s.",
 368                        filename, cf_section_lineno(cs), name2);
 369                 free(home);
 370                 return 0;
 371         }
 372
 373         if (home->response_window < 5) home->response_window = 5;
 374         if (home->response_window > 60) home->response_window = 60;
 375
 376         if (home->max_outstanding < 8) home->max_outstanding = 8;
 377         if (home->max_outstanding > 65536*16) home->max_outstanding = 65536*16;
 378
 379         if (home->ping_interval < 6) home->ping_interval = 6;
 380         if (home->ping_interval > 120) home->ping_interval = 120;
 381
 382         if (home->zombie_period < 20) home->zombie_period = 20;
 383         if (home->zombie_period > 120) home->zombie_period = 120;
 384
 385         if (home->zombie_period < home->response_window) {
 386                 home->zombie_period = home->response_window;
 387         }
 388
 389         if (home->num_pings_to_alive < 3) home->num_pings_to_alive = 3;
 390         if (home->num_pings_to_alive > 10) home->num_pings_to_alive = 10;
 391
 392         if (home->ping_timeout < 3) home->ping_timeout = 3;
 393         if (home->ping_timeout > 10) home->ping_timeout = 10;
 394
 395         if (home->revive_interval < 60) home->revive_interval = 60;
 396         if (home->revive_interval > 3600) home->revive_interval = 3600;
 397
 398         return 1;
 399 }
 400
 401
 402 static int server_pool_add(const char *filename, CONF_SECTION *cs, int type)
 403 {
 404         const char *name2;
 405         home_pool_t *pool = NULL;
 406         const char *value;
 407         CONF_PAIR *cp;
 408         int num_home_servers;
 409
 410         name2 = cf_section_name1(cs);
 411         if (!name2 || (strcasecmp(name2, "server_pool") != 0)) {
 412                 radlog(L_ERR, "%s[%d]: Section is not a server_pool.",
 413                        filename, cf_section_lineno(cs));
 414                 return 0;
 415         }
 416
 417         name2 = cf_section_name2(cs);
 418         if (!name2) {
 419                 radlog(L_ERR, "%s[%d]: Server pool section is missing a name.",
 420                        filename, cf_section_lineno(cs));
 421                 return 0;
 422         }
 423
 424         /*
 425          *      Count the home servers and initalize them.
 426          */
 427         num_home_servers = 0;
 428         for (cp = cf_pair_find(cs, "home_server");
 429              cp != NULL;
 430              cp = cf_pair_find_next(cs, cp, "home_server")) {
 431                 home_server myhome, *home;
 432                 CONF_SECTION *server_cs;
 433
 434                 num_home_servers++;
 435
 436                 value = cf_pair_value(cp);
 437                 if (!value) {
 438                         radlog(L_ERR, "%s[%d]: No value given for home_server.",
 439                                filename, cf_pair_lineno(cp));
 440                         return 0;;
 441                 }
 442
 443                 myhome.name = value;
 444                 myhome.type = type;
 445                 home = rbtree_finddata(home_servers_byname, &myhome);
 446                 if (home) continue;
 447
 448                 server_cs = cf_section_sub_find_name2(NULL,
 449                                                       "home_server",
 450                                                       value);
 451                 if (!server_cs) {
 452                         radlog(L_ERR, "%s[%d]: Unknown home_server \"%s\".",
 453                                filename, cf_pair_lineno(cp), value);
 454                         return 0;
 455                 }
 456
 457                 if (!home_server_add(filename, server_cs)) {
 458                         return 0;
 459                 }
 460
 461                 home = rbtree_finddata(home_servers_byname, &myhome);
 462                 if (!home) {
 463                         radlog(L_ERR, "Internal sanity check failed %d",
 464                                __LINE__);
 465                         return 0;
 466                 }
 467         }
 468
 469         if (num_home_servers == 0) {
 470                 radlog(L_ERR, "%s[%d]: No home servers defined in pool %s",
 471                        filename, cf_section_lineno(cs), name2);
 472                 goto error;
 473         }
 474
 475         pool = rad_malloc(sizeof(*pool) + num_home_servers * sizeof(pool->servers[0]));
 476         memset(pool, 0, sizeof(*pool) + num_home_servers * sizeof(pool->servers[0]));
 477
 478         pool->type = HOME_POOL_FAIL_OVER;
 479         pool->name = name2;
 480
 481         DEBUG2(" server_pool %s {", name2);
 482
 483         cp = cf_pair_find(cs, "type");
 484         if (cp) {
 485                 static LRAD_NAME_NUMBER pool_types[] = {
 486                         { "load-balance", HOME_POOL_LOAD_BALANCE },
 487                         { "fail-over", HOME_POOL_FAIL_OVER },
 488                         { "round_robin", HOME_POOL_LOAD_BALANCE },
 489                         { "fail_over", HOME_POOL_FAIL_OVER },
 490                         { "client-balance", HOME_POOL_CLIENT_BALANCE },
 491                         { "client-port-balance", HOME_POOL_CLIENT_PORT_BALANCE },
 492                         { NULL, 0 }
 493                 };
 494
 495                 value = cf_pair_value(cp);
 496                 if (!value) {
 497                         radlog(L_ERR, "%s[%d]: No value given for type.",
 498                                filename, cf_pair_lineno(cp));
 499                         goto error;
 500                 }
 501
 502                 pool->type = lrad_str2int(pool_types, value, 0);
 503                 if (!pool->type) {
 504                         radlog(L_ERR, "%s[%d]: Unknown type \"%s\".",
 505                                filename, cf_pair_lineno(cp), value);
 506                         goto error;
 507                 }
 508
 509                 DEBUG2("\ttype = %s", name2, value);
 510         }
 511
 512         for (cp = cf_pair_find(cs, "home_server");
 513              cp != NULL;
 514              cp = cf_pair_find_next(cs, cp, "home_server")) {
 515                 home_server myhome, *home;
 516
 517                 value = cf_pair_value(cp);
 518                 if (!value) {
 519                         radlog(L_ERR, "%s[%d]: No value given for home_server.",
 520                                filename, cf_pair_lineno(cp));
 521                         goto error;
 522                 }
 523
 524                 myhome.name = value;
 525                 myhome.type = type;
 526
 527                 home = rbtree_finddata(home_servers_byname, &myhome);
 528                 if (!home) {
 529                         DEBUG2("Internal sanity check failed");
 530                         goto error;
 531                 }
 532
 533                 if (!pool->server_type) {
 534                         rad_assert(home->type != 0);
 535                         pool->server_type = home->type;
 536
 537                 } else if (pool->server_type != home->type) {
 538                         radlog(L_ERR, "%s[%d]: Home server \"%s\" is not of the same type as previous servers in server pool %s",
 539                                filename, cf_pair_lineno(cp), value, pool->name);
 540                         goto error;
 541                 }
 542
 543                 if (0) {
 544                         DEBUG2("Warning: Duplicate home server %s in server pool %s", home->name, pool->name);
 545                         continue;
 546                 }
 547
 548                 DEBUG2("\thome_server = %s", home->name);
 549                 pool->servers[pool->num_home_servers] = home;
 550                 pool->num_home_servers++;
 551         } /* loop over home_server's */
 552
 553         if (!rbtree_insert(home_pools_byname, pool)) {
 554                 rad_assert("Internal sanity check failed");
 555                 goto error;
 556         }
 557
 558         DEBUG2(" }");
 559
 560         rad_assert(pool->server_type != 0);
 561
 562         return 1;
 563
 564  error:
 565         DEBUG2(" }");
 566         free(pool);
 567         return 0;
 568 }
 569
 570
 571 static int old_server_add(const char *filename, int lineno, const char *realm,
 572                           const char *name, const char *secret,
 573                           home_pool_type_t ldflag, home_pool_t **pool_p,
 574                           int type)
 575 {
 576         int i, insert_point, num_home_servers;
 577         home_server myhome, *home;
 578         home_pool_t mypool, *pool;
 579         CONF_SECTION *cs;
 580
 581         /*
 582          *      LOCAL realms get sanity checked, and nothing else happens.
 583          */
 584         if (strcmp(name, "LOCAL") == 0) {
 585                 if (*pool_p) {
 586                         radlog(L_ERR, "%s[%d]: Realm \"%s\" cannot be both LOCAL and remote", filename, lineno, name);
 587                         return 0;
 588                 }
 589                 return 1;
 590         }
 591
 592         mypool.name = realm;
 593         mypool.server_type = type;
 594         pool = rbtree_finddata(home_pools_byname, &mypool);
 595         if (pool) {
 596                 if (pool->type != ldflag) {
 597                         radlog(L_ERR, "%s[%d]: Inconsistent ldflag for server pool \"%s\"", filename, lineno, name);
 598                         return 0;
 599                 }
 600
 601                 if (pool->server_type != type) {
 602                         radlog(L_ERR, "%s[%d]: Inconsistent home server type for server pool \"%s\"", filename, lineno, name);
 603                         return 0;
 604                 }
 605         }
 606
 607         myhome.name = name;
 608         myhome.type = type;
 609         home = rbtree_finddata(home_servers_byname, &myhome);
 610         if (home) {
 611                 if (strcmp(home->secret, secret) != 0) {
 612                         radlog(L_ERR, "%s[%d]: Inconsistent shared secret for home server \"%s\"", filename, lineno, name);
 613                         return 0;
 614                 }
 615
 616                 if (home->type != type) {
 617                         radlog(L_ERR, "%s[%d]: Inconsistent type for home server \"%s\"", filename, lineno, name);
 618                         return 0;
 619                 }
 620
 621                 /*
 622                  *      See if the home server is already listed
 623                  *      in the pool.  If so, do nothing else.
 624                  */
 625                 if (pool) for (i = 0; i < pool->num_home_servers; i++) {
 626                         if (pool->servers[i] == home) {
 627                                 return 1;
 628                         }
 629                 }
 630         }
 631
 632         /*
 633          *      If we do have a pool, check that there is room to
 634          *      insert the home server we've found, or the one that we
 635          *      create here.
 636          *
 637          *      Note that we insert it into the LAST available
 638          *      position, in order to maintain the same order as in
 639          *      the configuration files.
 640          */
 641         insert_point = -1;
 642         if (pool) {
 643                 for (i = pool->num_home_servers - 1; i >= 0; i--) {
 644                         if (pool->servers[i]) break;
 645
 646                         if (!pool->servers[i]) {
 647                                 insert_point = i;
 648                         }
 649                 }
 650
 651                 if (insert_point < 0) {
 652                         radlog(L_ERR, "%s[%d]: No room in pool to add home server \"%s\".  Please update the realm configuration to use the new-style home servers and server pools.", filename, lineno, name);
 653                         return 0;
 654                 }
 655         }
 656
 657         /*
 658          *      No home server, allocate one.
 659          */
 660         if (!home) {
 661                 const char *p;
 662                 char *q;
 663
 664                 home = rad_malloc(sizeof(*home));
 665                 memset(home, 0, sizeof(*home));
 666
 667                 home->name = name;
 668                 home->hostname = name;
 669                 home->type = type;
 670                 home->secret = secret;
 671
 672                 p = strchr(name, ':');
 673                 if (!p) {
 674                         if (type == HOME_TYPE_AUTH) {
 675                                 home->port = PW_AUTH_UDP_PORT;
 676                         } else {
 677                                 home->port = PW_ACCT_UDP_PORT;
 678                         }
 679
 680                         p = name;
 681                         q = NULL;
 682
 683                 } else if (p == name) {
 684                                 radlog(L_ERR, "%s[%d]: Invalid hostname %s.",
 685                                        filename, lineno, name);
 686                                 free(home);
 687                                 return 0;
 688
 689                 } else {
 690                         home->port = atoi(p + 1);
 691                         if ((home->port == 0) || (home->port > 65535)) {
 692                                 radlog(L_ERR, "%s[%d]: Invalid port %s.",
 693                                        filename, lineno, p + 1);
 694                                 free(home);
 695                                 return 0;
 696                         }
 697
 698                         q = rad_malloc((p - name) + 1);
 699                         memcpy(q, name, (p - name));
 700                         q[p - name] = '\0';
 701                         p = q;
 702                 }
 703
 704                 if (ip_hton(p, AF_UNSPEC, &home->ipaddr) < 0) {
 705                         radlog(L_ERR, "%s[%d]: Failed looking up hostname %s.",
 706                                filename, lineno, p);
 707                         free(home);
 708                         free(q);
 709                         return 0;
 710                 }
 711                 free(q);
 712
 713                 /*
 714                  *      Use the old-style configuration.
 715                  */
 716                 home->max_outstanding = 65535*16;
 717                 home->zombie_period = mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count;
 718                 if (home->zombie_period == 0) home->zombie_period =30;
 719                 home->response_window = home->zombie_period - 1;
 720
 721                 home->ping_check = HOME_PING_CHECK_NONE;
 722
 723                 home->revive_interval = mainconfig.proxy_dead_time;
 724
 725                 if (rbtree_finddata(home_servers_byaddr, home)) {
 726                         radlog(L_ERR, "%s[%d]: Home server %s has the same IP address as another home server.",
 727                                filename, lineno, name);
 728                         free(home);
 729                         return 0;
 730                 }
 731
 732                 if (!rbtree_insert(home_servers_byname, home)) {
 733                         radlog(L_ERR, "%s[%d]: Internal error adding home server %s.",
 734                                filename, lineno, name);
 735                         free(home);
 736                         return 0;
 737                 }
 738
 739                 if (!rbtree_insert(home_servers_byaddr, home)) {
 740                         rbtree_deletebydata(home_servers_byname, home);
 741                         radlog(L_ERR, "%s[%d]: Internal error adding home server %s.",
 742                                filename, lineno, name);
 743                         free(home);
 744                         return 0;
 745                 }
 746         }
 747
 748         /*
 749          *      We now have a home server, see if we can insert it
 750          *      into pre-existing pool.
 751          */
 752         if (insert_point >= 0) {
 753                 rad_assert(pool != NULL);
 754                 pool->servers[insert_point] = home;
 755                 return 1;
 756         }
 757
 758         rad_assert(pool == NULL);
 759         rad_assert(home != NULL);
 760
 761         /*
 762          *      Count the old-style realms of this name.
 763          */
 764         num_home_servers = 0;
 765         for (cs = cf_section_sub_find_name2(mainconfig.config, "realm", realm);
 766              cs != NULL;
 767              cs = cf_section_sub_find_name2(cs, "realm", realm)) {
 768                 num_home_servers++;
 769         }
 770
 771         pool = rad_malloc(sizeof(*pool) + num_home_servers * sizeof(pool->servers[0]));
 772         memset(pool, 0, sizeof(*pool) + num_home_servers * sizeof(pool->servers[0]));
 773
 774         pool->name = realm;
 775         pool->type = ldflag;
 776         pool->server_type = type;
 777         pool->num_home_servers = num_home_servers;
 778         pool->servers[0] = home;
 779
 780         if (!rbtree_insert(home_pools_byname, pool)) {
 781                 rad_assert("Internal sanity check failed");
 782                 return 0;
 783         }
 784
 785         *pool_p = pool;
 786
 787         return 1;
 788 }
 789
 790 static int old_realm_config(const char *filename, CONF_SECTION *cs, REALM *r)
 791 {
 792         char *host;
 793         const char *secret;
 794         home_pool_type_t ldflag;
 795
 796         secret = cf_section_value_find(cs, "secret");
 797
 798         host = cf_section_value_find(cs, "ldflag");
 799         if (!host ||
 800             (strcasecmp(host, "fail_over") == 0)) {
 801                 ldflag = HOME_POOL_FAIL_OVER;
 802                 DEBUG2("\tldflag = fail_over");
 803
 804         } else if (strcasecmp(host, "round_robin") == 0) {
 805                 ldflag = HOME_POOL_LOAD_BALANCE;
 806                 DEBUG2("\tldflag = round_robin");
 807
 808         } else {
 809                 radlog(L_ERR, "%s[%d]: Unknown value \"%s\" for ldflag",
 810                        filename, cf_section_lineno(cs), host);
 811                 return 0;
 812         }
 813
 814         /*
 815          *      Allow old-style if it doesn't exist, or if it exists and
 816          *      it's LOCAL.
 817          */
 818         if (((host = cf_section_value_find(cs, "authhost")) != NULL) &&
 819             (strcmp(host, "LOCAL") != 0)) {
 820                 if (!secret) {
 821                         radlog(L_ERR, "%s[%d]: No shared secret supplied for realm: %s",
 822                                filename, cf_section_lineno(cs), r->name);
 823                         return 0;
 824                 }
 825
 826                 DEBUG2("\tauthhost = %s",  host);
 827
 828                 if (!old_server_add(filename, cf_section_lineno(cs),
 829                                     r->name, host, secret, ldflag,
 830                                     &r->auth_pool, HOME_TYPE_AUTH)) {
 831                         return 0;
 832                 }
 833         }
 834
 835         if (((host = cf_section_value_find(cs, "accthost")) != NULL) &&
 836             (strcmp(host, "LOCAL") != 0)) {
 837                 if (!secret) {
 838                         radlog(L_ERR, "%s[%d]: No shared secret supplied for realm: %s",
 839                                filename, cf_section_lineno(cs), r->name);
 840                         return 0;
 841                 }
 842
 843                 DEBUG2("\taccthost = %s", host);
 844
 845                 if (!old_server_add(filename, cf_section_lineno(cs),
 846                                     r->name, host, secret, ldflag,
 847                                     &r->acct_pool, HOME_TYPE_ACCT)) {
 848                         return 0;
 849                 }
 850         }
 851
 852         if (secret) DEBUG2("\tsecret = %s", secret);
 853
 854         return 1;
 855
 856 }
 857
 858
 859 static int add_pool_to_realm(const char *filename, int lineno,
 860                              const char *name, home_pool_t **dest,
 861                              int server_type)
 862 {
 863         home_pool_t mypool, *pool;
 864
 865         mypool.name = name;
 866         mypool.server_type = server_type;
 867         pool = rbtree_finddata(home_pools_byname, &mypool);
 868         if (!pool) {
 869                 CONF_SECTION *pool_cs;
 870
 871                 pool_cs = cf_section_sub_find_name2(NULL, "server_pool",
 872                                                     name);
 873                 if (!pool_cs) {
 874                         radlog(L_ERR, "%s[%d]: Failed to find server_pool \"%s\"",
 875                                filename, lineno, name);
 876                         return 0;
 877                 }
 878
 879                 if (!server_pool_add(filename, pool_cs, server_type)) {
 880                         return 0;
 881                 }
 882
 883                 pool = rbtree_finddata(home_pools_byname, &mypool);
 884                 if (!pool) {
 885                         radlog(L_ERR, "Internal sanity check failed in add_pool_to_realm");
 886                         return 0;
 887                 }
 888         }
 889
 890         if (pool->server_type != server_type) {
 891                 radlog(L_ERR, "%s[%d]: Incompatible server_pool \"%s\" (mixed auth_pool / acct_pool)",
 892                        filename, lineno, name);
 893                 return 0;
 894         }
 895
 896         *dest = pool;
 897
 898         return 1;
 899 }
 900
 901 int realm_add(const char *filename, CONF_SECTION *cs)
 902 {
 903         const char *name2;
 904         REALM *r = NULL;
 905         CONF_PAIR *cp;
 906         home_pool_t *auth_pool, *acct_pool;
 907         const char *auth_pool_name, *acct_pool_name;
 908
 909         name2 = cf_section_name1(cs);
 910         if (!name2 || (strcasecmp(name2, "realm") != 0)) {
 911                 radlog(L_ERR, "%s[%d]: Section is not a realm.",
 912                        filename, cf_section_lineno(cs));
 913                 return 0;
 914         }
 915
 916         name2 = cf_section_name2(cs);
 917         if (!name2) {
 918                 radlog(L_ERR, "%s[%d]: Realm section is missing the realm name.",
 919                        filename, cf_section_lineno(cs));
 920                 return 0;
 921         }
 922
 923         auth_pool = acct_pool = NULL;
 924         auth_pool_name = acct_pool_name = NULL;
 925
 926         /*
 927          *      Prefer new configuration to old one.
 928          */
 929         cp = cf_pair_find(cs, "auth_pool");
 930         if (cp) auth_pool_name = cf_pair_value(cp);
 931         if (cp && auth_pool_name) {
 932                 if (!add_pool_to_realm(filename, cf_pair_lineno(cp),
 933                                        auth_pool_name, &auth_pool,
 934                                        HOME_TYPE_AUTH)) {
 935                         return 0;
 936                 }
 937         }
 938
 939         cp = cf_pair_find(cs, "acct_pool");
 940         if (cp) acct_pool_name = cf_pair_value(cp);
 941         if (cp && acct_pool_name) {
 942                 if (!add_pool_to_realm(filename, cf_pair_lineno(cp),
 943                                        acct_pool_name, &acct_pool,
 944                                        HOME_TYPE_ACCT)) {
 945                         return 0;
 946                 }
 947         }
 948
 949         DEBUG2(" realm %s {", name2);
 950
 951         /*
 952          *      The realm MAY already exist if it's an old-style realm.
 953          *      In that case, merge the old-style realm with this one.
 954          */
 955         r = realm_find(name2);
 956         if (r) {
 957                 if (cf_pair_find(cs, "auth_pool") ||
 958                     cf_pair_find(cs, "acct_pool")) {
 959                         radlog(L_ERR, "%s[%d]: Duplicate realm \"%s\"",
 960                                filename, cf_section_lineno(cs), name2);
 961                         goto error;
 962                 }
 963
 964                 if (!old_realm_config(filename, cs, r)) {
 965                         goto error;
 966                 }
 967
 968                 DEBUG2(" } # realm %s", name2);
 969                 return 1;
 970         }
 971
 972         r = rad_malloc(sizeof(*r));
 973         memset(r, 0, sizeof(*r));
 974
 975         r->name = name2;
 976         r->auth_pool = auth_pool;
 977         r->acct_pool = acct_pool;
 978         r->striprealm = 1;
 979
 980         if (auth_pool_name) DEBUG2("\tauth_pool = %s", auth_pool_name);
 981         if (acct_pool_name) DEBUG2("\tacct_pool = %s", acct_pool_name);
 982
 983         if ((cf_section_value_find(cs, "nostrip")) != NULL) {
 984                 r->striprealm = 0;
 985                 DEBUG2("\tnostrip", name2);
 986         }
 987
 988         /*
 989          *      We're a new-style realm.  Complain if we see the old
 990          *      directives.
 991          */
 992         if (r->auth_pool || r->acct_pool) {
 993                 if (((cp = cf_pair_find(cs, "authhost")) != NULL) ||
 994                     ((cp = cf_pair_find(cs, "accthost")) != NULL) ||
 995                     ((cp = cf_pair_find(cs, "secret")) != NULL) ||
 996                     ((cp = cf_pair_find(cs, "ldflag")) != NULL)) {
 997                         DEBUG2("WARNING: Ignoring old-style configuration entry \"%s\" in realm \"%s\"", cf_pair_attr(cp), r->name);
 998                 }
 999
1000
1001                 /*
1002                  *      The realm MAY be an old-style realm, as there
1003                  *      was no auth_pool or acct_pool.  Double-check
1004                  *      it, just to be safe.
1005                  */
1006         } else if (!old_realm_config(filename, cs, r)) {
1007                 goto error;
1008         }
1009
1010         if (!rbtree_insert(realms_byname, r)) {
1011                 rad_assert("Internal sanity check failed");
1012                 goto error;
1013         }
1014
1015         DEBUG2(" }");
1016
1017         return 1;
1018
1019  error:
1020         DEBUG2(" } # realm %s", name2);
1021         free(r);
1022         return 0;
1023 }
1024
1025
1026 /*
1027  *      Find a realm in the REALM list.
1028  */
1029 REALM *realm_find(const char *name)
1030 {
1031         REALM myrealm;
1032
1033         if (!name) name = "NULL";
1034
1035         myrealm.name = name;
1036         return rbtree_finddata(realms_byname, &myrealm);
1037 }
1038
1039
1040 home_server *home_server_ldb(const char *realmname,
1041                              home_pool_t *pool, REQUEST *request)
1042 {
1043         int             start;
1044         int             count;
1045         home_server     *found = NULL;
1046
1047         start = 0;
1048
1049         /*
1050          *      Determine how to pick choose the home server.
1051          */
1052         switch (pool->type) {
1053                 uint32_t hash;
1054
1055                 /*
1056                  *      For load-balancing by client IP address, we
1057                  *      pick a home server by hashing the client IP.
1058                  *
1059                  *      This isn't as even a load distribution as
1060                  *      tracking the State attribute, but it's better
1061                  *      than nothing.
1062                  */
1063         case HOME_POOL_CLIENT_BALANCE:
1064                 switch (request->packet->src_ipaddr.af) {
1065                 case AF_INET:
1066                         hash = lrad_hash(&request->packet->src_ipaddr.ipaddr.ip4addr,
1067                                          sizeof(request->packet->src_ipaddr.ipaddr.ip4addr));
1068                         break;
1069                 case AF_INET6:
1070                         hash = lrad_hash(&request->packet->src_ipaddr.ipaddr.ip6addr,
1071                                          sizeof(request->packet->src_ipaddr.ipaddr.ip6addr));
1072                         break;
1073                 default:
1074                         hash = 0;
1075                         break;
1076                 }
1077                 start = hash % pool->num_home_servers;
1078                 break;
1079
1080         case HOME_POOL_CLIENT_PORT_BALANCE:
1081                 switch (request->packet->src_ipaddr.af) {
1082                 case AF_INET:
1083                         hash = lrad_hash(&request->packet->src_ipaddr.ipaddr.ip4addr,
1084                                          sizeof(request->packet->src_ipaddr.ipaddr.ip4addr));
1085                         break;
1086                 case AF_INET6:
1087                         hash = lrad_hash(&request->packet->src_ipaddr.ipaddr.ip6addr,
1088                                          sizeof(request->packet->src_ipaddr.ipaddr.ip6addr));
1089                         break;
1090                 default:
1091                         hash = 0;
1092                         break;
1093                 }
1094                 lrad_hash_update(&request->packet->src_port,
1095                                  sizeof(request->packet->src_port), hash);
1096                 start = hash % pool->num_home_servers;
1097                 break;
1098
1099         case HOME_POOL_LOAD_BALANCE:
1100                 found = pool->servers[0];
1101
1102         default:
1103                 start = 0;
1104                 break;
1105         }
1106
1107         /*
1108          *      Starting with the home server we chose, loop through
1109          *      all home servers.  If the current one is dead, skip
1110          *      it.  If it is too busy, skip it.
1111          *
1112          *      Otherwise, use it.
1113          */
1114         for (count = 0; count < pool->num_home_servers; count++) {
1115                 home_server *home = pool->servers[(start + count) % pool->num_home_servers];
1116
1117                 if (home->state == HOME_STATE_IS_DEAD) {
1118                         continue;
1119                 }
1120
1121                 /*
1122                  *      This home server is too busy.  Choose another one.
1123                  */
1124                 if (home->currently_outstanding >= home->max_outstanding) {
1125                         continue;
1126                 }
1127
1128                 if (pool->type != HOME_POOL_LOAD_BALANCE) {
1129                         return home;
1130                 }
1131
1132                 DEBUG3("PROXY %s %d\t%s %d",
1133                        found->name, found->currently_outstanding,
1134                        home->name, home->currently_outstanding);
1135
1136                 /*
1137                  *      Prefer this server if it's less busy than the
1138                  *      one we previously found.
1139                  */
1140                 if (home->currently_outstanding < found->currently_outstanding) {
1141                         DEBUG3("Choosing %s: It's less busy than %s",
1142                                home->name, found->name);
1143                         found = home;
1144                         continue;
1145                 }
1146
1147                 /*
1148                  *      Ignore servers which are busier than the one
1149                  *      we found.
1150                  */
1151                 if (home->currently_outstanding > found->currently_outstanding) {
1152                         DEBUG3("Skipping %s: It's busier than %s",
1153                                home->name, found->name);
1154                         continue;
1155                 }
1156
1157                 /*
1158                  *      From the list of servers which have the same
1159                  *      load, choose one at random.
1160                  */
1161                 if (((count + 1) * (lrad_rand() & 0xffff)) < (uint32_t) 0x10000) {
1162                         found = home;
1163                 }
1164
1165         } /* loop over the home servers */
1166
1167         if (found) return found;
1168
1169         /*
1170          *      No live match found, and no fallback to the "DEFAULT"
1171          *      realm.  We fix this by blindly marking all servers as
1172          *      "live".  But only do it for ones that don't support
1173          *      "pings", as they will be marked live when they
1174          *      actually are live.
1175          */
1176         if (!mainconfig.proxy_fallback &&
1177             mainconfig.wake_all_if_all_dead) {
1178                 home_server *lb = NULL;
1179
1180                 for (count = 0; count < pool->num_home_servers; count++) {
1181                         home_server *home = pool->servers[count];
1182
1183                         if ((home->state == HOME_STATE_IS_DEAD) &&
1184                             (home->ping_check == HOME_PING_CHECK_NONE)) {
1185                                 home->state = HOME_STATE_ALIVE;
1186                                 if (!lb) lb = home;
1187                         }
1188                 }
1189
1190                 if (lb) return lb;
1191         }
1192
1193         /*
1194          *      Still nothing.  Look up the DEFAULT realm, but only
1195          *      if we weren't looking up the NULL or DEFAULT realms.
1196          */
1197         if (mainconfig.proxy_fallback &&
1198             realmname &&
1199             (strcmp(realmname, "NULL") != 0) &&
1200             (strcmp(realmname, "DEFAULT") != 0)) {
1201                 REALM *rd = realm_find("DEFAULT");
1202
1203                 if (!rd) return NULL;
1204
1205                 pool = NULL;
1206                 if (request->packet->code == PW_AUTHENTICATION_REQUEST) {
1207                         pool = rd->auth_pool;
1208
1209                 } else if (request->packet->code == PW_ACCOUNTING_REQUEST) {
1210                         pool = rd->acct_pool;
1211                 }
1212                 if (!pool) return NULL;
1213
1214                 DEBUG2("  Realm %s has no live home servers.  Falling back to the DEFAULT realm.", realmname);
1215                 return home_server_ldb(rd->name, pool, request);
1216         }
1217
1218         /*
1219          *      Still haven't found anything.  Oh well.
1220          */
1221         return NULL;
1222 }
1223
1224
1225 home_server *home_server_find(lrad_ipaddr_t *ipaddr, int port)
1226 {
1227         home_server myhome;
1228
1229         myhome.ipaddr = *ipaddr;
1230         myhome.port = port;
1231
1232         return rbtree_finddata(home_servers_byaddr, &myhome);
1233 }