src/main/realms.c

   1 /*
   2  * realms.c     Realm handling code
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2007  The FreeRADIUS server project
  21  * Copyright 2007  Alan DeKok <aland@deployingradius.com>
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include <freeradius-devel/radiusd.h>
  28 #include <freeradius-devel/rad_assert.h>
  29
  30 #include <sys/stat.h>
  31
  32 #include <ctype.h>
  33 #include <fcntl.h>
  34
  35 static rbtree_t *realms_byname = NULL;
  36
  37 static rbtree_t *home_servers_byaddr = NULL;
  38 static rbtree_t *home_servers_byname = NULL;
  39
  40 static rbtree_t *home_pools_byname = NULL;
  41
  42 typedef struct realm_config_t {
  43         CONF_SECTION    *cs;
  44         int             dead_time;
  45         int             retry_count;
  46         int             retry_delay;
  47         int             fallback;
  48         int             wake_all_if_all_dead;
  49 } realm_config_t;
  50
  51 static realm_config_t *realm_config = NULL;
  52
  53 /*
  54  *  Map the proxy server configuration parameters to variables.
  55  */
  56 static const CONF_PARSER proxy_config[] = {
  57         { "retry_delay",  PW_TYPE_INTEGER,
  58           offsetof(realm_config_t, retry_delay),
  59           NULL, Stringify(RETRY_DELAY) },
  60
  61         { "retry_count",  PW_TYPE_INTEGER,
  62           offsetof(realm_config_t, retry_count),
  63           NULL, Stringify(RETRY_COUNT) },
  64
  65         { "default_fallback", PW_TYPE_BOOLEAN,
  66           offsetof(realm_config_t, fallback),
  67           NULL, "no" },
  68
  69         { "dead_time",    PW_TYPE_INTEGER,
  70           offsetof(realm_config_t, dead_time),
  71           NULL, Stringify(DEAD_TIME) },
  72
  73         { "wake_all_if_all_dead", PW_TYPE_BOOLEAN,
  74           offsetof(realm_config_t, wake_all_if_all_dead),
  75           NULL, "no" },
  76
  77         { NULL, -1, 0, NULL, NULL }
  78 };
  79
  80 static int realm_name_cmp(const void *one, const void *two)
  81 {
  82         const REALM *a = one;
  83         const REALM *b = two;
  84
  85         return strcasecmp(a->name, b->name);
  86 }
  87
  88
  89 static int home_server_name_cmp(const void *one, const void *two)
  90 {
  91         const home_server *a = one;
  92         const home_server *b = two;
  93
  94         if (a->type < b->type) return -1;
  95         if (a->type > b->type) return +1;
  96
  97         return strcasecmp(a->name, b->name);
  98 }
  99
 100 static int home_server_addr_cmp(const void *one, const void *two)
 101 {
 102         const home_server *a = one;
 103         const home_server *b = two;
 104
 105         if (a->server && !b->server) return -1;
 106         if (!a->server && b->server) return +1;
 107         if (a->server && b->server) {
 108                 int rcode = a->type - b->type;
 109                 if (rcode != 0) return rcode;
 110                 return strcmp(a->server, b->server);
 111         }
 112
 113         if (a->port < b->port) return -1;
 114         if (a->port > b->port) return +1;
 115
 116         return fr_ipaddr_cmp(&a->ipaddr, &b->ipaddr);
 117 }
 118
 119
 120 static int home_pool_name_cmp(const void *one, const void *two)
 121 {
 122         const home_pool_t *a = one;
 123         const home_pool_t *b = two;
 124
 125         if (a->server_type < b->server_type) return -1;
 126         if (a->server_type > b->server_type) return +1;
 127
 128         return strcasecmp(a->name, b->name);
 129 }
 130
 131
 132 /*
 133  *      Xlat for %{home_server:foo}
 134  */
 135 static size_t xlat_home_server(UNUSED void *instance, REQUEST *request,
 136                                char *fmt, char *out, size_t outlen,
 137                                UNUSED RADIUS_ESCAPE_STRING func)
 138 {
 139         const char *value = NULL;
 140         CONF_PAIR *cp;
 141
 142         if (!fmt || !out || (outlen < 1)) return 0;
 143
 144         if (!request || !request->home_server) {
 145                 *out = '\0';
 146                 return 0;
 147         }
 148
 149         cp = cf_pair_find(request->home_server->cs, fmt);
 150         if (!cp || !(value = cf_pair_value(cp))) {
 151                 *out = '\0';
 152                 return 0;
 153         }
 154
 155         strlcpy(out, value, outlen);
 156
 157         return strlen(out);
 158 }
 159
 160
 161 /*
 162  *      Xlat for %{home_server_pool:foo}
 163  */
 164 static size_t xlat_server_pool(UNUSED void *instance, REQUEST *request,
 165                                char *fmt, char *out, size_t outlen,
 166                                UNUSED RADIUS_ESCAPE_STRING func)
 167 {
 168         const char *value = NULL;
 169         CONF_PAIR *cp;
 170
 171         if (!fmt || !out || (outlen < 1)) return 0;
 172
 173         if (!request || !request->home_pool) {
 174                 *out = '\0';
 175                 return 0;
 176         }
 177
 178         cp = cf_pair_find(request->home_pool->cs, fmt);
 179         if (!cp || !(value = cf_pair_value(cp))) {
 180                 *out = '\0';
 181                 return 0;
 182         }
 183
 184         strlcpy(out, value, outlen);
 185
 186         return strlen(out);
 187 }
 188
 189
 190 void realms_free(void)
 191 {
 192         rbtree_free(home_servers_byname);
 193         home_servers_byname = NULL;
 194
 195         rbtree_free(home_servers_byaddr);
 196         home_servers_byaddr = NULL;
 197
 198         rbtree_free(home_pools_byname);
 199         home_pools_byname = NULL;
 200
 201         rbtree_free(realms_byname);
 202         realms_byname = NULL;
 203
 204         free(realm_config);
 205 }
 206
 207
 208 static struct in_addr hs_ip4addr;
 209 static struct in6_addr hs_ip6addr;
 210 static char *hs_type = NULL;
 211 static char *hs_check = NULL;
 212
 213 static CONF_PARSER home_server_config[] = {
 214         { "ipaddr",  PW_TYPE_IPADDR,
 215           0, &hs_ip4addr,  NULL },
 216         { "ipv6addr",  PW_TYPE_IPV6ADDR,
 217           0, &hs_ip6addr, NULL },
 218
 219         { "port", PW_TYPE_INTEGER,
 220           offsetof(home_server,port), NULL,   "0" },
 221
 222         { "type",  PW_TYPE_STRING_PTR,
 223           0, &hs_type, NULL },
 224
 225         { "secret",  PW_TYPE_STRING_PTR,
 226           offsetof(home_server,secret), NULL,  NULL},
 227
 228         { "response_window", PW_TYPE_INTEGER,
 229           offsetof(home_server,response_window), NULL,   "30" },
 230         { "max_outstanding", PW_TYPE_INTEGER,
 231           offsetof(home_server,max_outstanding), NULL,   "65536" },
 232
 233         { "zombie_period", PW_TYPE_INTEGER,
 234           offsetof(home_server,zombie_period), NULL,   "40" },
 235         { "status_check", PW_TYPE_STRING_PTR,
 236           0, &hs_check,   "none" },
 237         { "ping_check", PW_TYPE_STRING_PTR,
 238           0, &hs_check,   "none" },
 239
 240         { "ping_interval", PW_TYPE_INTEGER,
 241           offsetof(home_server,ping_interval), NULL,   "30" },
 242         { "check_interval", PW_TYPE_INTEGER,
 243           offsetof(home_server,ping_interval), NULL,   "30" },
 244         { "num_answers_to_alive", PW_TYPE_INTEGER,
 245           offsetof(home_server,num_pings_to_alive), NULL,   "3" },
 246         { "num_pings_to_alive", PW_TYPE_INTEGER,
 247           offsetof(home_server,num_pings_to_alive), NULL,   "3" },
 248         { "revive_interval", PW_TYPE_INTEGER,
 249           offsetof(home_server,revive_interval), NULL,   "300" },
 250         { "status_check_timeout", PW_TYPE_INTEGER,
 251           offsetof(home_server,ping_timeout), NULL,   "4" },
 252
 253         { "username",  PW_TYPE_STRING_PTR,
 254           offsetof(home_server,ping_user_name), NULL,  NULL},
 255         { "password",  PW_TYPE_STRING_PTR,
 256           offsetof(home_server,ping_user_password), NULL,  NULL},
 257
 258         { NULL, -1, 0, NULL, NULL }             /* end the list */
 259
 260 };
 261
 262
 263 static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int type)
 264 {
 265         const char *name2;
 266         home_server *home;
 267         int dual = FALSE;
 268         CONF_PAIR *cp;
 269
 270         name2 = cf_section_name1(cs);
 271         if (!name2 || (strcasecmp(name2, "home_server") != 0)) {
 272                 cf_log_err(cf_sectiontoitem(cs),
 273                            "Section is not a home_server.");
 274                 return 0;
 275         }
 276
 277         name2 = cf_section_name2(cs);
 278         if (!name2) {
 279                 cf_log_err(cf_sectiontoitem(cs),
 280                            "Home server section is missing a name.");
 281                 return 0;
 282         }
 283
 284         home = rad_malloc(sizeof(*home));
 285         memset(home, 0, sizeof(*home));
 286
 287         home->name = name2;
 288         home->cs = cs;
 289
 290         memset(&hs_ip4addr, 0, sizeof(hs_ip4addr));
 291         memset(&hs_ip6addr, 0, sizeof(hs_ip6addr));
 292         cf_section_parse(cs, home, home_server_config);
 293
 294         /*
 295          *      Figure out which one to use.
 296          */
 297         if (cf_pair_find(cs, "ipaddr")) {
 298                 home->ipaddr.af = AF_INET;
 299                 home->ipaddr.ipaddr.ip4addr = hs_ip4addr;
 300
 301         } else if (cf_pair_find(cs, "ipv6addr")) {
 302                 home->ipaddr.af = AF_INET6;
 303                 home->ipaddr.ipaddr.ip6addr = hs_ip6addr;
 304
 305         } else if ((cp = cf_pair_find(cs, "virtual_server")) != NULL) {
 306                 home->ipaddr.af = AF_UNSPEC;
 307                 home->server = cf_pair_value(cp);
 308                 if (!home->server) {
 309                         cf_log_err(cf_sectiontoitem(cs),
 310                                    "Invalid value for virtual_server");
 311                         goto error;
 312                 }
 313
 314                 if (!cf_section_sub_find_name2(rc->cs, "server", home->server)) {
 315
 316                         cf_log_err(cf_sectiontoitem(cs),
 317                                    "No such server %s", home->server);
 318                         goto error;
 319                 }
 320
 321                 free(hs_type);
 322                 hs_type = NULL;
 323                 home->secret = "";
 324                 goto skip_port;
 325
 326         } else {
 327                 cf_log_err(cf_sectiontoitem(cs),
 328                            "No ipaddr, ipv6addr, or virtual_server defined for home server \"%s\".",
 329                            name2);
 330         error:
 331                 free(home);
 332                 free(hs_type);
 333                 hs_type = NULL;
 334                 free(hs_check);
 335                 hs_check = NULL;
 336                 return 0;
 337         }
 338
 339         if (!home->port || (home->port > 65535)) {
 340                 cf_log_err(cf_sectiontoitem(cs),
 341                            "No port, or invalid port defined for home server %s.",
 342                            name2);
 343                 goto error;
 344         }
 345
 346         if (0) {
 347                 cf_log_err(cf_sectiontoitem(cs),
 348                            "Fatal error!  Home server %s is ourselves!",
 349                            name2);
 350                 goto error;
 351         }
 352
 353         if (!home->secret) {
 354                 cf_log_err(cf_sectiontoitem(cs),
 355                            "No shared secret defined for home server %s.",
 356                            name2);
 357                 free(home);
 358                 return 0;
 359         }
 360
 361         /*
 362          *      Use a reasonable default.
 363          */
 364  skip_port:
 365         if (!hs_type) hs_type = strdup("auth+acct");
 366
 367         if (strcasecmp(hs_type, "auth") == 0) {
 368                 home->type = HOME_TYPE_AUTH;
 369                 if (type != home->type) {
 370                         cf_log_err(cf_sectiontoitem(cs),
 371                                    "Server pool of \"acct\" servers cannot include home server %s of type \"auth\"",
 372                                    name2);
 373                         free(home);
 374                         return 0;
 375                 }
 376
 377         } else if (strcasecmp(hs_type, "acct") == 0) {
 378                 home->type = HOME_TYPE_ACCT;
 379                 if (type != home->type) {
 380                         cf_log_err(cf_sectiontoitem(cs),
 381                                    "Server pool of \"auth\" servers cannot include home server %s of type \"acct\"",
 382                                    name2);
 383                         free(home);
 384                         return 0;
 385                 }
 386
 387         } else if (strcasecmp(hs_type, "auth+acct") == 0) {
 388                 home->type = HOME_TYPE_AUTH;
 389                 dual = TRUE;
 390
 391         } else {
 392                 cf_log_err(cf_sectiontoitem(cs),
 393                            "Invalid type \"%s\" for home server %s.",
 394                            hs_type, name2);
 395                 free(home);
 396                 free(hs_type);
 397                 hs_type = NULL;
 398                 free(hs_check);
 399                 hs_check = NULL;
 400                 return 0;
 401         }
 402         free(hs_type);
 403         hs_type = NULL;
 404
 405         if (!hs_check || (strcasecmp(hs_check, "none") == 0)) {
 406                 home->ping_check = HOME_PING_CHECK_NONE;
 407
 408         } else if (strcasecmp(hs_check, "status-server") == 0) {
 409                 home->ping_check = HOME_PING_CHECK_STATUS_SERVER;
 410
 411         } else if (strcasecmp(hs_check, "request") == 0) {
 412                 home->ping_check = HOME_PING_CHECK_REQUEST;
 413
 414         } else {
 415                 cf_log_err(cf_sectiontoitem(cs),
 416                            "Invalid ping_check \"%s\" for home server %s.",
 417                            hs_check, name2);
 418                 free(home);
 419                 free(hs_check);
 420                 hs_check = NULL;
 421                 return 0;
 422         }
 423         free(hs_check);
 424         hs_check = NULL;
 425
 426         if ((home->ping_check != HOME_PING_CHECK_NONE) &&
 427             (home->ping_check != HOME_PING_CHECK_STATUS_SERVER)) {
 428                 if (!home->ping_user_name) {
 429                         cf_log_err(cf_sectiontoitem(cs), "You must supply a user name to enable ping checks");
 430                         free(home);
 431                         return 0;
 432                 }
 433
 434                 if ((home->type == HOME_TYPE_AUTH) &&
 435                     !home->ping_user_password) {
 436                         cf_log_err(cf_sectiontoitem(cs), "You must supply a password to enable ping checks");
 437                         free(home);
 438                         return 0;
 439                 }
 440         }
 441
 442         if (rbtree_finddata(home_servers_byaddr, home)) {
 443                 DEBUG2("Ignoring duplicate home server %s.", name2);
 444                 return 1;
 445         }
 446
 447         if (!rbtree_insert(home_servers_byname, home)) {
 448                 cf_log_err(cf_sectiontoitem(cs),
 449                            "Internal error adding home server %s.",
 450                            name2);
 451                 free(home);
 452                 return 0;
 453         }
 454
 455         if (!rbtree_insert(home_servers_byaddr, home)) {
 456                 rbtree_deletebydata(home_servers_byname, home);
 457                 cf_log_err(cf_sectiontoitem(cs),
 458                            "Internal error adding home server %s.",
 459                            name2);
 460                 free(home);
 461                 return 0;
 462         }
 463
 464         if (home->response_window < 5) home->response_window = 5;
 465         if (home->response_window > 60) home->response_window = 60;
 466
 467         if (home->max_outstanding < 8) home->max_outstanding = 8;
 468         if (home->max_outstanding > 65536*16) home->max_outstanding = 65536*16;
 469
 470         if (home->ping_interval < 6) home->ping_interval = 6;
 471         if (home->ping_interval > 120) home->ping_interval = 120;
 472
 473         if (home->zombie_period < 20) home->zombie_period = 20;
 474         if (home->zombie_period > 120) home->zombie_period = 120;
 475
 476         if (home->zombie_period < home->response_window) {
 477                 home->zombie_period = home->response_window;
 478         }
 479
 480         if (home->num_pings_to_alive < 3) home->num_pings_to_alive = 3;
 481         if (home->num_pings_to_alive > 10) home->num_pings_to_alive = 10;
 482
 483         if (home->ping_timeout < 3) home->ping_timeout = 3;
 484         if (home->ping_timeout > 10) home->ping_timeout = 10;
 485
 486         if (home->revive_interval < 60) home->revive_interval = 60;
 487         if (home->revive_interval > 3600) home->revive_interval = 3600;
 488
 489         if (dual) {
 490                 home_server *home2 = rad_malloc(sizeof(*home2));
 491
 492                 memcpy(home2, home, sizeof(*home2));
 493
 494                 home2->type = HOME_TYPE_ACCT;
 495                 home2->port++;
 496                 home2->ping_user_password = NULL;
 497                 home2->cs = cs;
 498
 499                 if (!rbtree_insert(home_servers_byname, home2)) {
 500                         cf_log_err(cf_sectiontoitem(cs),
 501                                    "Internal error adding home server %s.",
 502                                    name2);
 503                         free(home2);
 504                         return 0;
 505                 }
 506
 507                 if (!rbtree_insert(home_servers_byaddr, home2)) {
 508                         rbtree_deletebydata(home_servers_byname, home2);
 509                         cf_log_err(cf_sectiontoitem(cs),
 510                                    "Internal error adding home server %s.",
 511                                    name2);
 512                         free(home2);
 513                         return 0;
 514                 }
 515         }
 516
 517         return 1;
 518 }
 519
 520
 521 static home_pool_t *server_pool_alloc(const char *name, home_pool_type_t type,
 522                                       int server_type, int num_home_servers)
 523 {
 524         home_pool_t *pool;
 525
 526         pool = rad_malloc(sizeof(*pool) + (sizeof(pool->servers[0]) *
 527                                            num_home_servers));
 528         if (!pool) return NULL; /* just for pairanoia */
 529
 530         memset(pool, 0, sizeof(*pool) + (sizeof(pool->servers[0]) *
 531                                          num_home_servers));
 532
 533         pool->name = name;
 534         pool->type = type;
 535         pool->server_type = server_type;
 536         pool->num_home_servers = num_home_servers;
 537
 538         return pool;
 539 }
 540
 541
 542 static int server_pool_add(realm_config_t *rc,
 543                            CONF_SECTION *cs, int server_type, int do_print)
 544 {
 545         const char *name2;
 546         home_pool_t *pool = NULL;
 547         const char *value;
 548         CONF_PAIR *cp;
 549         int num_home_servers;
 550
 551         name2 = cf_section_name1(cs);
 552         if (!name2 || ((strcasecmp(name2, "server_pool") != 0) &&
 553                        (strcasecmp(name2, "home_server_pool") != 0))) {
 554                 cf_log_err(cf_sectiontoitem(cs),
 555                            "Section is not a home_server_pool.");
 556                 return 0;
 557         }
 558
 559         name2 = cf_section_name2(cs);
 560         if (!name2) {
 561                 cf_log_err(cf_sectiontoitem(cs),
 562                            "Server pool section is missing a name.");
 563                 return 0;
 564         }
 565
 566         /*
 567          *      Count the home servers and initalize them.
 568          */
 569         num_home_servers = 0;
 570         for (cp = cf_pair_find(cs, "home_server");
 571              cp != NULL;
 572              cp = cf_pair_find_next(cs, cp, "home_server")) {
 573                 home_server myhome, *home;
 574                 CONF_SECTION *server_cs;
 575
 576                 num_home_servers++;
 577
 578                 value = cf_pair_value(cp);
 579                 if (!value) {
 580                         cf_log_err(cf_pairtoitem(cp),
 581                                    "No value given for home_server.");
 582                         return 0;;
 583                 }
 584
 585                 myhome.name = value;
 586                 myhome.type = server_type;
 587                 home = rbtree_finddata(home_servers_byname, &myhome);
 588                 if (home) continue;
 589
 590                 server_cs = cf_section_sub_find_name2(rc->cs,
 591                                                       "home_server",
 592                                                       value);
 593                 if (!server_cs) {
 594                         cf_log_err(cf_pairtoitem(cp),
 595                                    "Unknown home_server \"%s\".",
 596                                    value);
 597                         return 0;
 598                 }
 599
 600                 if (!home_server_add(rc, server_cs, server_type)) {
 601                         return 0;
 602                 }
 603
 604                 home = rbtree_finddata(home_servers_byname, &myhome);
 605                 if (!home) {
 606                         radlog(L_ERR, "Internal sanity check failed %d",
 607                                __LINE__);
 608                         return 0;
 609                 }
 610         }
 611
 612         if (num_home_servers == 0) {
 613                 cf_log_err(cf_sectiontoitem(cs),
 614                            "No home servers defined in pool %s",
 615                            name2);
 616                 goto error;
 617         }
 618
 619         pool = server_pool_alloc(name2, HOME_POOL_FAIL_OVER, server_type,
 620                                  num_home_servers);
 621         pool->cs = cs;
 622
 623         if (do_print) cf_log_info(cs, " home_server_pool %s {", name2);
 624
 625         cp = cf_pair_find(cs, "type");
 626         if (cp) {
 627                 static FR_NAME_NUMBER pool_types[] = {
 628                         { "load-balance", HOME_POOL_LOAD_BALANCE },
 629                         { "fail-over", HOME_POOL_FAIL_OVER },
 630                         { "round_robin", HOME_POOL_LOAD_BALANCE },
 631                         { "fail_over", HOME_POOL_FAIL_OVER },
 632                         { "client-balance", HOME_POOL_CLIENT_BALANCE },
 633                         { "client-port-balance", HOME_POOL_CLIENT_PORT_BALANCE },
 634                         { "keyed-balance", HOME_POOL_KEYED_BALANCE },
 635                         { NULL, 0 }
 636                 };
 637
 638                 value = cf_pair_value(cp);
 639                 if (!value) {
 640                         cf_log_err(cf_pairtoitem(cp),
 641                                    "No value given for type.");
 642                         goto error;
 643                 }
 644
 645                 pool->type = fr_str2int(pool_types, value, 0);
 646                 if (!pool->type) {
 647                         cf_log_err(cf_pairtoitem(cp),
 648                                    "Unknown type \"%s\".",
 649                                    value);
 650                         goto error;
 651                 }
 652
 653                 if (do_print) cf_log_info(cs, "\ttype = %s", value);
 654         }
 655
 656         cp = cf_pair_find(cs, "virtual_server");
 657         if (cp) {
 658                 pool->virtual_server = cf_pair_value(cp);
 659                 if (do_print && pool->virtual_server) {
 660                         cf_log_info(cs, "\tvirtual_server = %s", pool->virtual_server);
 661                 }
 662
 663                 if (!cf_section_sub_find_name2(rc->cs, "server",
 664                                                pool->virtual_server)) {
 665                         cf_log_err(cf_pairtoitem(cp), "No such server %s",
 666                                    pool->virtual_server);
 667                         goto error;
 668                 }
 669
 670         }
 671
 672         num_home_servers = 0;
 673         for (cp = cf_pair_find(cs, "home_server");
 674              cp != NULL;
 675              cp = cf_pair_find_next(cs, cp, "home_server")) {
 676                 home_server myhome, *home;
 677
 678                 value = cf_pair_value(cp);
 679                 if (!value) {
 680                         cf_log_err(cf_pairtoitem(cp),
 681                                    "No value given for home_server.");
 682                         goto error;
 683                 }
 684
 685                 myhome.name = value;
 686                 myhome.type = server_type;
 687
 688                 home = rbtree_finddata(home_servers_byname, &myhome);
 689                 if (!home) {
 690                         DEBUG2("Internal sanity check failed");
 691                         goto error;
 692                 }
 693
 694                 if (0) {
 695                         DEBUG2("Warning: Duplicate home server %s in server pool %s", home->name, pool->name);
 696                         continue;
 697                 }
 698
 699                 if (do_print) cf_log_info(cs, "\thome_server = %s", home->name);
 700                 pool->servers[num_home_servers++] = home;
 701         } /* loop over home_server's */
 702
 703         if (!rbtree_insert(home_pools_byname, pool)) {
 704                 rad_assert("Internal sanity check failed");
 705                 goto error;
 706         }
 707
 708         if (do_print) cf_log_info(cs, " }");
 709
 710         rad_assert(pool->server_type != 0);
 711
 712         return 1;
 713
 714  error:
 715         if (do_print) cf_log_info(cs, " }");
 716         free(pool);
 717         return 0;
 718 }
 719
 720
 721 static int old_server_add(realm_config_t *rc, CONF_SECTION *cs,
 722                           const char *realm,
 723                           const char *name, const char *secret,
 724                           home_pool_type_t ldflag, home_pool_t **pool_p,
 725                           int type, const char *server)
 726 {
 727         int i, insert_point, num_home_servers;
 728         home_server myhome, *home;
 729         home_pool_t mypool, *pool;
 730         CONF_SECTION *subcs;
 731
 732         /*
 733          *      LOCAL realms get sanity checked, and nothing else happens.
 734          */
 735         if (strcmp(name, "LOCAL") == 0) {
 736                 if (*pool_p) {
 737                         cf_log_err(cf_sectiontoitem(cs), "Realm \"%s\" cannot be both LOCAL and remote", name);
 738                         return 0;
 739                 }
 740                 return 1;
 741         }
 742
 743         mypool.name = realm;
 744         mypool.server_type = type;
 745         pool = rbtree_finddata(home_pools_byname, &mypool);
 746         if (pool) {
 747                 if (pool->type != ldflag) {
 748                         cf_log_err(cf_sectiontoitem(cs), "Inconsistent ldflag for server pool \"%s\"", name);
 749                         return 0;
 750                 }
 751
 752                 if (pool->server_type != type) {
 753                         cf_log_err(cf_sectiontoitem(cs), "Inconsistent home server type for server pool \"%s\"", name);
 754                         return 0;
 755                 }
 756         }
 757
 758         myhome.name = name;
 759         myhome.type = type;
 760         home = rbtree_finddata(home_servers_byname, &myhome);
 761         if (home) {
 762                 if (strcmp(home->secret, secret) != 0) {
 763                         cf_log_err(cf_sectiontoitem(cs), "Inconsistent shared secret for home server \"%s\"", name);
 764                         return 0;
 765                 }
 766
 767                 if (home->type != type) {
 768                         cf_log_err(cf_sectiontoitem(cs), "Inconsistent type for home server \"%s\"", name);
 769                         return 0;
 770                 }
 771
 772                 /*
 773                  *      See if the home server is already listed
 774                  *      in the pool.  If so, do nothing else.
 775                  */
 776                 if (pool) for (i = 0; i < pool->num_home_servers; i++) {
 777                         if (pool->servers[i] == home) {
 778                                 return 1;
 779                         }
 780                 }
 781         }
 782
 783         /*
 784          *      If we do have a pool, check that there is room to
 785          *      insert the home server we've found, or the one that we
 786          *      create here.
 787          *
 788          *      Note that we insert it into the LAST available
 789          *      position, in order to maintain the same order as in
 790          *      the configuration files.
 791          */
 792         insert_point = -1;
 793         if (pool) {
 794                 for (i = pool->num_home_servers - 1; i >= 0; i--) {
 795                         if (pool->servers[i]) break;
 796
 797                         if (!pool->servers[i]) {
 798                                 insert_point = i;
 799                         }
 800                 }
 801
 802                 if (insert_point < 0) {
 803                         cf_log_err(cf_sectiontoitem(cs), "No room in pool to add home server \"%s\".  Please update the realm configuration to use the new-style home servers and server pools.", name);
 804                         return 0;
 805                 }
 806         }
 807
 808         /*
 809          *      No home server, allocate one.
 810          */
 811         if (!home) {
 812                 const char *p;
 813                 char *q;
 814
 815                 home = rad_malloc(sizeof(*home));
 816                 memset(home, 0, sizeof(*home));
 817
 818                 home->name = name;
 819                 home->hostname = name;
 820                 home->type = type;
 821                 home->secret = secret;
 822                 home->cs = cs;
 823
 824                 p = strchr(name, ':');
 825                 if (!p) {
 826                         if (type == HOME_TYPE_AUTH) {
 827                                 home->port = PW_AUTH_UDP_PORT;
 828                         } else {
 829                                 home->port = PW_ACCT_UDP_PORT;
 830                         }
 831
 832                         p = name;
 833                         q = NULL;
 834
 835                 } else if (p == name) {
 836                                 cf_log_err(cf_sectiontoitem(cs),
 837                                            "Invalid hostname %s.",
 838                                            name);
 839                                 free(home);
 840                                 return 0;
 841
 842                 } else {
 843                         home->port = atoi(p + 1);
 844                         if ((home->port == 0) || (home->port > 65535)) {
 845                                 cf_log_err(cf_sectiontoitem(cs),
 846                                            "Invalid port %s.",
 847                                            p + 1);
 848                                 free(home);
 849                                 return 0;
 850                         }
 851
 852                         q = rad_malloc((p - name) + 1);
 853                         memcpy(q, name, (p - name));
 854                         q[p - name] = '\0';
 855                         p = q;
 856                 }
 857
 858                 if (!server) {
 859                         if (ip_hton(p, AF_UNSPEC, &home->ipaddr) < 0) {
 860                                 cf_log_err(cf_sectiontoitem(cs),
 861                                            "Failed looking up hostname %s.",
 862                                            p);
 863                                 free(home);
 864                                 free(q);
 865                                 return 0;
 866                         }
 867                 } else {
 868                         home->ipaddr.af = AF_UNSPEC;
 869                         home->server = server;
 870                 }
 871                 free(q);
 872
 873                 /*
 874                  *      Use the old-style configuration.
 875                  */
 876                 home->max_outstanding = 65535*16;
 877                 home->zombie_period = rc->retry_delay * rc->retry_count;
 878                 if (home->zombie_period == 0) home->zombie_period =30;
 879                 home->response_window = home->zombie_period - 1;
 880
 881                 home->ping_check = HOME_PING_CHECK_NONE;
 882
 883                 home->revive_interval = rc->dead_time;
 884
 885                 if (rbtree_finddata(home_servers_byaddr, home)) {
 886                         cf_log_err(cf_sectiontoitem(cs), "Home server %s has the same IP address and/or port as another home server.", name);
 887                         free(home);
 888                         return 0;
 889                 }
 890
 891                 if (!rbtree_insert(home_servers_byname, home)) {
 892                         cf_log_err(cf_sectiontoitem(cs), "Internal error adding home server %s.", name);
 893                         free(home);
 894                         return 0;
 895                 }
 896
 897                 if (!rbtree_insert(home_servers_byaddr, home)) {
 898                         rbtree_deletebydata(home_servers_byname, home);
 899                         cf_log_err(cf_sectiontoitem(cs), "Internal error adding home server %s.", name);
 900                         free(home);
 901                         return 0;
 902                 }
 903         }
 904
 905         /*
 906          *      We now have a home server, see if we can insert it
 907          *      into pre-existing pool.
 908          */
 909         if (insert_point >= 0) {
 910                 rad_assert(pool != NULL);
 911                 pool->servers[insert_point] = home;
 912                 return 1;
 913         }
 914
 915         rad_assert(pool == NULL);
 916         rad_assert(home != NULL);
 917
 918         /*
 919          *      Count the old-style realms of this name.
 920          */
 921         num_home_servers = 0;
 922         for (subcs = cf_section_find_next(cs, NULL, "realm");
 923              subcs != NULL;
 924              subcs = cf_section_find_next(cs, subcs, "realm")) {
 925                 const char *this = cf_section_name2(subcs);
 926
 927                 if (!this || (strcmp(this, realm) != 0)) continue;
 928                 num_home_servers++;
 929         }
 930
 931         if (num_home_servers == 0) {
 932                 cf_log_err(cf_sectiontoitem(cs), "Internal error counting pools for home server %s.", name);
 933                 free(home);
 934                 return 0;
 935         }
 936
 937         pool = server_pool_alloc(realm, ldflag, type, num_home_servers);
 938         pool->cs = cs;
 939
 940         pool->servers[0] = home;
 941
 942         if (!rbtree_insert(home_pools_byname, pool)) {
 943                 rad_assert("Internal sanity check failed");
 944                 return 0;
 945         }
 946
 947         *pool_p = pool;
 948
 949         return 1;
 950 }
 951
 952 static int old_realm_config(realm_config_t *rc, CONF_SECTION *cs, REALM *r)
 953 {
 954         const char *host;
 955         const char *secret = NULL;
 956         home_pool_type_t ldflag;
 957         CONF_PAIR *cp;
 958
 959         cp = cf_pair_find(cs, "ldflag");
 960         ldflag = HOME_POOL_FAIL_OVER;
 961         if (cp) {
 962                 host = cf_pair_value(cp);
 963                 if (!host) {
 964                         cf_log_err(cf_pairtoitem(cp), "No value specified for ldflag");
 965                         return 0;
 966                 }
 967
 968                 if (strcasecmp(host, "fail_over") == 0) {
 969                         cf_log_info(cs, "\tldflag = fail_over");
 970
 971                 } else if (strcasecmp(host, "round_robin") == 0) {
 972                         ldflag = HOME_POOL_LOAD_BALANCE;
 973                         cf_log_info(cs, "\tldflag = round_robin");
 974
 975                 } else {
 976                         cf_log_err(cf_sectiontoitem(cs), "Unknown value \"%s\" for ldflag", host);
 977                         return 0;
 978                 }
 979         } /* else don't print it. */
 980
 981         /*
 982          *      Allow old-style if it doesn't exist, or if it exists and
 983          *      it's LOCAL.
 984          */
 985         cp = cf_pair_find(cs, "authhost");
 986         if (cp) {
 987                 host = cf_pair_value(cp);
 988                 if (!host) {
 989                         cf_log_err(cf_pairtoitem(cp), "No value specified for authhost");
 990                         return 0;
 991                 }
 992
 993                 if (strcmp(host, "LOCAL") != 0) {
 994                         cp = cf_pair_find(cs, "secret");
 995                         if (!cp) {
 996                                 cf_log_err(cf_sectiontoitem(cs), "No shared secret supplied for realm: %s", r->name);
 997                                 return 0;
 998                         }
 999
1000                         secret = cf_pair_value(cp);
1001                         if (!secret) {
1002                                 cf_log_err(cf_pairtoitem(cp), "No value specified for secret");
1003                                 return 0;
1004                         }
1005                 }
1006
1007                 cf_log_info(cs, "\tauthhost = %s",  host);
1008
1009                 if (!old_server_add(rc, cs, r->name, host, secret, ldflag,
1010                                     &r->auth_pool, HOME_TYPE_AUTH, NULL)) {
1011                         return 0;
1012                 }
1013         }
1014
1015         cp = cf_pair_find(cs, "accthost");
1016         if (cp) {
1017                 host = cf_pair_value(cp);
1018                 if (!host) {
1019                         cf_log_err(cf_pairtoitem(cp), "No value specified for accthost");
1020                         return 0;
1021                 }
1022
1023                 /*
1024                  *      Don't look for a secret again if it was found
1025                  *      above.
1026                  */
1027                 if ((strcmp(host, "LOCAL") != 0) && !secret) {
1028                         cp = cf_pair_find(cs, "secret");
1029                         if (!cp) {
1030                                 cf_log_err(cf_sectiontoitem(cs), "No shared secret supplied for realm: %s", r->name);
1031                                 return 0;
1032                         }
1033
1034                         secret = cf_pair_value(cp);
1035                         if (!secret) {
1036                                 cf_log_err(cf_pairtoitem(cp), "No value specified for secret");
1037                                 return 0;
1038                         }
1039                 }
1040
1041                 cf_log_info(cs, "\taccthost = %s", host);
1042
1043                 if (!old_server_add(rc, cs, r->name, host, secret, ldflag,
1044                                     &r->acct_pool, HOME_TYPE_ACCT, NULL)) {
1045                         return 0;
1046                 }
1047         }
1048
1049         cp = cf_pair_find(cs, "virtual_server");
1050         if (cp) {
1051                 host = cf_pair_value(cp);
1052                 if (!host) {
1053                         cf_log_err(cf_pairtoitem(cp), "No value specified for virtual_server");
1054                         return 0;
1055                 }
1056
1057                 cf_log_info(cs, "\tvirtual_server = %s", host);
1058
1059                 if (!old_server_add(rc, cs, r->name, host, "", ldflag,
1060                                     &r->auth_pool, HOME_TYPE_AUTH, host)) {
1061                         return 0;
1062                 }
1063                 if (!old_server_add(rc, cs, r->name, host, "", ldflag,
1064                                     &r->acct_pool, HOME_TYPE_ACCT, host)) {
1065                         return 0;
1066                 }
1067         }
1068
1069         if (secret) cf_log_info(cs, "\tsecret = %s", secret);
1070
1071         return 1;
1072
1073 }
1074
1075
1076 static int add_pool_to_realm(realm_config_t *rc, CONF_SECTION *cs,
1077                              const char *name, home_pool_t **dest,
1078                              int server_type, int do_print)
1079 {
1080         home_pool_t mypool, *pool;
1081
1082         mypool.name = name;
1083         mypool.server_type = server_type;
1084
1085         pool = rbtree_finddata(home_pools_byname, &mypool);
1086         if (!pool) {
1087                 CONF_SECTION *pool_cs;
1088
1089                 pool_cs = cf_section_sub_find_name2(rc->cs,
1090                                                     "home_server_pool",
1091                                                     name);
1092                 if (!pool_cs) {
1093                         pool_cs = cf_section_sub_find_name2(rc->cs,
1094                                                             "server_pool",
1095                                                             name);
1096                 }
1097                 if (!pool_cs) {
1098                         cf_log_err(cf_sectiontoitem(cs), "Failed to find home_server_pool \"%s\"", name);
1099                         return 0;
1100                 }
1101
1102                 if (!server_pool_add(rc, pool_cs, server_type, do_print)) {
1103                         return 0;
1104                 }
1105
1106                 pool = rbtree_finddata(home_pools_byname, &mypool);
1107                 if (!pool) {
1108                         radlog(L_ERR, "Internal sanity check failed in add_pool_to_realm");
1109                         return 0;
1110                 }
1111         }
1112
1113         if (pool->server_type != server_type) {
1114                 cf_log_err(cf_sectiontoitem(cs), "Incompatible home_server_pool \"%s\" (mixed auth_pool / acct_pool)", name);
1115                 return 0;
1116         }
1117
1118         *dest = pool;
1119
1120         return 1;
1121 }
1122
1123 static int realm_add(realm_config_t *rc, CONF_SECTION *cs)
1124 {
1125         const char *name2;
1126         REALM *r = NULL;
1127         CONF_PAIR *cp;
1128         home_pool_t *auth_pool, *acct_pool;
1129         const char *auth_pool_name, *acct_pool_name;
1130
1131         name2 = cf_section_name1(cs);
1132         if (!name2 || (strcasecmp(name2, "realm") != 0)) {
1133                 cf_log_err(cf_sectiontoitem(cs), "Section is not a realm.");
1134                 return 0;
1135         }
1136
1137         name2 = cf_section_name2(cs);
1138         if (!name2) {
1139                 cf_log_err(cf_sectiontoitem(cs), "Realm section is missing the realm name.");
1140                 return 0;
1141         }
1142
1143         auth_pool = acct_pool = NULL;
1144         auth_pool_name = acct_pool_name = NULL;
1145
1146         /*
1147          *      Prefer new configuration to old one.
1148          */
1149         cp = cf_pair_find(cs, "pool");
1150         if (!cp) cp = cf_pair_find(cs, "home_server_pool");
1151         if (cp) auth_pool_name = cf_pair_value(cp);
1152         if (cp && auth_pool_name) {
1153                 acct_pool_name = auth_pool_name;
1154                 if (!add_pool_to_realm(rc, cs,
1155                                        auth_pool_name, &auth_pool,
1156                                        HOME_TYPE_AUTH, 1)) {
1157                         return 0;
1158                 }
1159                 if (!add_pool_to_realm(rc, cs,
1160                                        auth_pool_name, &acct_pool,
1161                                        HOME_TYPE_ACCT, 0)) {
1162                         return 0;
1163                 }
1164         }
1165
1166         cp = cf_pair_find(cs, "auth_pool");
1167         if (cp) auth_pool_name = cf_pair_value(cp);
1168         if (cp && auth_pool_name) {
1169                 if (auth_pool) {
1170                         cf_log_err(cf_sectiontoitem(cs), "Cannot use \"pool\" and \"auth_pool\" at the same time.");
1171                         return 0;
1172                 }
1173                 if (!add_pool_to_realm(rc, cs,
1174                                        auth_pool_name, &auth_pool,
1175                                        HOME_TYPE_AUTH, 1)) {
1176                         return 0;
1177                 }
1178         }
1179
1180         cp = cf_pair_find(cs, "acct_pool");
1181         if (cp) acct_pool_name = cf_pair_value(cp);
1182         if (cp && acct_pool_name) {
1183                 int do_print = TRUE;
1184
1185                 if (acct_pool) {
1186                         cf_log_err(cf_sectiontoitem(cs), "Cannot use \"pool\" and \"acct_pool\" at the same time.");
1187                         return 0;
1188                 }
1189
1190                 if (!auth_pool ||
1191                     (strcmp(auth_pool_name, acct_pool_name) != 0)) {
1192                         do_print = TRUE;
1193                 }
1194
1195                 if (!add_pool_to_realm(rc, cs,
1196                                        acct_pool_name, &acct_pool,
1197                                        HOME_TYPE_ACCT, do_print)) {
1198                         return 0;
1199                 }
1200         }
1201
1202         cf_log_info(cs, " realm %s {", name2);
1203
1204         /*
1205          *      The realm MAY already exist if it's an old-style realm.
1206          *      In that case, merge the old-style realm with this one.
1207          */
1208         r = realm_find(name2);
1209         if (r) {
1210                 if (cf_pair_find(cs, "auth_pool") ||
1211                     cf_pair_find(cs, "acct_pool")) {
1212                         cf_log_err(cf_sectiontoitem(cs), "Duplicate realm \"%s\"", name2);
1213                         goto error;
1214                 }
1215
1216                 if (!old_realm_config(rc, cs, r)) {
1217                         goto error;
1218                 }
1219
1220                 cf_log_info(cs, " } # realm %s", name2);
1221                 return 1;
1222         }
1223
1224         r = rad_malloc(sizeof(*r));
1225         memset(r, 0, sizeof(*r));
1226
1227         r->name = name2;
1228         r->auth_pool = auth_pool;
1229         r->acct_pool = acct_pool;
1230         r->striprealm = 1;
1231
1232         if (auth_pool_name &&
1233             (auth_pool_name == acct_pool_name)) { /* yes, ptr comparison */
1234                 cf_log_info(cs, "\tpool = %s", auth_pool_name);
1235         } else {
1236                 if (auth_pool_name) cf_log_info(cs, "\tauth_pool = %s", auth_pool_name);
1237                 if (acct_pool_name) cf_log_info(cs, "\tacct_pool = %s", acct_pool_name);
1238         }
1239
1240         cp = cf_pair_find(cs, "nostrip");
1241         if (cp && (cf_pair_value(cp) == NULL)) {
1242                 r->striprealm = 0;
1243                 cf_log_info(cs, "\tnostrip");
1244         }
1245
1246         /*
1247          *      We're a new-style realm.  Complain if we see the old
1248          *      directives.
1249          */
1250         if (r->auth_pool || r->acct_pool) {
1251                 if (((cp = cf_pair_find(cs, "authhost")) != NULL) ||
1252                     ((cp = cf_pair_find(cs, "accthost")) != NULL) ||
1253                     ((cp = cf_pair_find(cs, "secret")) != NULL) ||
1254                     ((cp = cf_pair_find(cs, "ldflag")) != NULL)) {
1255                         DEBUG2("WARNING: Ignoring old-style configuration entry \"%s\" in realm \"%s\"", cf_pair_attr(cp), r->name);
1256                 }
1257
1258
1259                 /*
1260                  *      The realm MAY be an old-style realm, as there
1261                  *      was no auth_pool or acct_pool.  Double-check
1262                  *      it, just to be safe.
1263                  */
1264         } else if (!old_realm_config(rc, cs, r)) {
1265                 goto error;
1266         }
1267
1268         if (!rbtree_insert(realms_byname, r)) {
1269                 rad_assert("Internal sanity check failed");
1270                 goto error;
1271         }
1272
1273         cf_log_info(cs, " }");
1274
1275         return 1;
1276
1277  error:
1278         cf_log_info(cs, " } # realm %s", name2);
1279         free(r);
1280         return 0;
1281 }
1282
1283
1284 int realms_init(CONF_SECTION *config)
1285 {
1286         CONF_SECTION *cs;
1287         realm_config_t *rc, *old_rc;
1288
1289         if (realms_byname) return 1;
1290
1291         realms_byname = rbtree_create(realm_name_cmp, free, 0);
1292         if (!realms_byname) {
1293                 realms_free();
1294                 return 0;
1295         }
1296
1297         home_servers_byaddr = rbtree_create(home_server_addr_cmp, free, 0);
1298         if (!home_servers_byaddr) {
1299                 realms_free();
1300                 return 0;
1301         }
1302
1303         home_servers_byname = rbtree_create(home_server_name_cmp, NULL, 0);
1304         if (!home_servers_byname) {
1305                 realms_free();
1306                 return 0;
1307         }
1308
1309         home_pools_byname = rbtree_create(home_pool_name_cmp, free, 0);
1310         if (!home_pools_byname) {
1311                 realms_free();
1312                 return 0;
1313         }
1314
1315         rc = rad_malloc(sizeof(*rc));
1316         memset(rc, 0, sizeof(*rc));
1317         rc->cs = config;
1318
1319         cs = cf_subsection_find_next(config, NULL, "proxy");
1320         if (cs) {
1321                 cf_section_parse(cs, rc, proxy_config);
1322         } else {
1323                 rc->dead_time = DEAD_TIME;
1324                 rc->retry_count = RETRY_COUNT;
1325                 rc->retry_delay = RETRY_DELAY;
1326                 rc->fallback = 0;
1327                 rc->wake_all_if_all_dead= 0;
1328         }
1329
1330         for (cs = cf_subsection_find_next(config, NULL, "realm");
1331              cs != NULL;
1332              cs = cf_subsection_find_next(config, cs, "realm")) {
1333                 if (!realm_add(rc, cs)) {
1334                         free(rc);
1335                         realms_free();
1336                         return 0;
1337                 }
1338         }
1339
1340         xlat_register("home_server", xlat_home_server, NULL);
1341         xlat_register("home_server_pool", xlat_server_pool, NULL);
1342
1343         /*
1344          *      Swap pointers atomically.
1345          */
1346         old_rc = realm_config;
1347         realm_config = rc;
1348         free(old_rc);
1349
1350         return 1;
1351 }
1352
1353
1354 /*
1355  *      Find a realm in the REALM list.
1356  */
1357 REALM *realm_find(const char *name)
1358 {
1359         REALM myrealm;
1360         REALM *realm;
1361
1362         if (!name) name = "NULL";
1363
1364         myrealm.name = name;
1365         realm = rbtree_finddata(realms_byname, &myrealm);
1366         if (realm) return realm;
1367
1368         /*
1369          *      Couldn't find a realm.  Look for DEFAULT.
1370          */
1371         myrealm.name = "DEFAULT";
1372         return rbtree_finddata(realms_byname, &myrealm);
1373 }
1374
1375
1376 home_server *home_server_ldb(const char *realmname,
1377                              home_pool_t *pool, REQUEST *request)
1378 {
1379         int             start;
1380         int             count;
1381         home_server     *found = NULL;
1382         VALUE_PAIR      *vp;
1383
1384         start = 0;
1385
1386         /*
1387          *      Determine how to pick choose the home server.
1388          */
1389         switch (pool->type) {
1390                 uint32_t hash;
1391
1392                 /*
1393                  *      For load-balancing by client IP address, we
1394                  *      pick a home server by hashing the client IP.
1395                  *
1396                  *      This isn't as even a load distribution as
1397                  *      tracking the State attribute, but it's better
1398                  *      than nothing.
1399                  */
1400         case HOME_POOL_CLIENT_BALANCE:
1401                 switch (request->packet->src_ipaddr.af) {
1402                 case AF_INET:
1403                         hash = fr_hash(&request->packet->src_ipaddr.ipaddr.ip4addr,
1404                                          sizeof(request->packet->src_ipaddr.ipaddr.ip4addr));
1405                         break;
1406                 case AF_INET6:
1407                         hash = fr_hash(&request->packet->src_ipaddr.ipaddr.ip6addr,
1408                                          sizeof(request->packet->src_ipaddr.ipaddr.ip6addr));
1409                         break;
1410                 default:
1411                         hash = 0;
1412                         break;
1413                 }
1414                 start = hash % pool->num_home_servers;
1415                 break;
1416
1417         case HOME_POOL_CLIENT_PORT_BALANCE:
1418                 switch (request->packet->src_ipaddr.af) {
1419                 case AF_INET:
1420                         hash = fr_hash(&request->packet->src_ipaddr.ipaddr.ip4addr,
1421                                          sizeof(request->packet->src_ipaddr.ipaddr.ip4addr));
1422                         break;
1423                 case AF_INET6:
1424                         hash = fr_hash(&request->packet->src_ipaddr.ipaddr.ip6addr,
1425                                          sizeof(request->packet->src_ipaddr.ipaddr.ip6addr));
1426                         break;
1427                 default:
1428                         hash = 0;
1429                         break;
1430                 }
1431                 fr_hash_update(&request->packet->src_port,
1432                                  sizeof(request->packet->src_port), hash);
1433                 start = hash % pool->num_home_servers;
1434                 break;
1435
1436         case HOME_POOL_KEYED_BALANCE:
1437                 if ((vp = pairfind(request->config_items, PW_LOAD_BALANCE_KEY)) != NULL) {
1438                         hash = fr_hash(vp->vp_strvalue, vp->length);
1439                         start = hash % pool->num_home_servers;
1440                         break;
1441                 }
1442                 /* FALL-THROUGH */
1443
1444         case HOME_POOL_LOAD_BALANCE:
1445                 found = pool->servers[0];
1446
1447         default:
1448                 start = 0;
1449                 break;
1450         }
1451
1452         /*
1453          *      Starting with the home server we chose, loop through
1454          *      all home servers.  If the current one is dead, skip
1455          *      it.  If it is too busy, skip it.
1456          *
1457          *      Otherwise, use it.
1458          */
1459         for (count = 0; count < pool->num_home_servers; count++) {
1460                 home_server *home = pool->servers[(start + count) % pool->num_home_servers];
1461
1462                 if (home->state == HOME_STATE_IS_DEAD) {
1463                         continue;
1464                 }
1465
1466                 /*
1467                  *      This home server is too busy.  Choose another one.
1468                  */
1469                 if (home->currently_outstanding >= home->max_outstanding) {
1470                         continue;
1471                 }
1472
1473                 if (pool->type != HOME_POOL_LOAD_BALANCE) {
1474                         return home;
1475                 }
1476
1477                 DEBUG3("PROXY %s %d\t%s %d",
1478                        found->name, found->currently_outstanding,
1479                        home->name, home->currently_outstanding);
1480
1481                 /*
1482                  *      Prefer this server if it's less busy than the
1483                  *      one we previously found.
1484                  */
1485                 if (home->currently_outstanding < found->currently_outstanding) {
1486                         DEBUG3("Choosing %s: It's less busy than %s",
1487                                home->name, found->name);
1488                         found = home;
1489                         continue;
1490                 }
1491
1492                 /*
1493                  *      Ignore servers which are busier than the one
1494                  *      we found.
1495                  */
1496                 if (home->currently_outstanding > found->currently_outstanding) {
1497                         DEBUG3("Skipping %s: It's busier than %s",
1498                                home->name, found->name);
1499                         continue;
1500                 }
1501
1502                 if (home->total_requests_sent < found->total_requests_sent) {
1503                         DEBUG3("Choosing %s: It's been less busy than %s",
1504                                home->name, found->name);
1505                         found = home;
1506                         continue;
1507                 }
1508
1509                 if (home->total_requests_sent > found->total_requests_sent) {
1510                         DEBUG3("Skipping %s: It's been busier than %s",
1511                                home->name, found->name);
1512                         continue;
1513                 }
1514
1515                 /*
1516                  *      From the list of servers which have the same
1517                  *      load, choose one at random.
1518                  */
1519                 if (((count + 1) * (fr_rand() & 0xffff)) < (uint32_t) 0x10000) {
1520                         found = home;
1521                 }
1522
1523         } /* loop over the home servers */
1524
1525         if (found) return found;
1526
1527         /*
1528          *      No live match found, and no fallback to the "DEFAULT"
1529          *      realm.  We fix this by blindly marking all servers as
1530          *      "live".  But only do it for ones that don't support
1531          *      "pings", as they will be marked live when they
1532          *      actually are live.
1533          */
1534         if (!realm_config->fallback &&
1535             realm_config->wake_all_if_all_dead) {
1536                 home_server *lb = NULL;
1537
1538                 for (count = 0; count < pool->num_home_servers; count++) {
1539                         home_server *home = pool->servers[count];
1540
1541                         if ((home->state == HOME_STATE_IS_DEAD) &&
1542                             (home->ping_check == HOME_PING_CHECK_NONE)) {
1543                                 home->state = HOME_STATE_ALIVE;
1544                                 if (!lb) lb = home;
1545                         }
1546                 }
1547
1548                 if (lb) return lb;
1549         }
1550
1551         /*
1552          *      Still nothing.  Look up the DEFAULT realm, but only
1553          *      if we weren't looking up the NULL or DEFAULT realms.
1554          */
1555         if (realm_config->fallback &&
1556             realmname &&
1557             (strcmp(realmname, "NULL") != 0) &&
1558             (strcmp(realmname, "DEFAULT") != 0)) {
1559                 REALM *rd = realm_find("DEFAULT");
1560
1561                 if (!rd) return NULL;
1562
1563                 pool = NULL;
1564                 if (request->packet->code == PW_AUTHENTICATION_REQUEST) {
1565                         pool = rd->auth_pool;
1566
1567                 } else if (request->packet->code == PW_ACCOUNTING_REQUEST) {
1568                         pool = rd->acct_pool;
1569                 }
1570                 if (!pool) return NULL;
1571
1572                 DEBUG2("  Realm %s has no live home servers.  Falling back to the DEFAULT realm.", realmname);
1573                 return home_server_ldb(rd->name, pool, request);
1574         }
1575
1576         /*
1577          *      Still haven't found anything.  Oh well.
1578          */
1579         return NULL;
1580 }
1581
1582
1583 home_server *home_server_find(fr_ipaddr_t *ipaddr, int port)
1584 {
1585         home_server myhome;
1586
1587         memset(&myhome, 0, sizeof(myhome));
1588         myhome.ipaddr = *ipaddr;
1589         myhome.port = port;
1590         myhome.server = NULL;   /* we're not called for internal proxying */
1591
1592         return rbtree_finddata(home_servers_byaddr, &myhome);
1593 }