src/main/realms.c

   1 /*
   2  * realms.c     Realm handling code
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2007  The FreeRADIUS server project
  21  * Copyright 2007  Alan DeKok <aland@deployingradius.com>
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include <freeradius-devel/radiusd.h>
  28 #include <freeradius-devel/rad_assert.h>
  29
  30 #include <sys/stat.h>
  31
  32 #include <ctype.h>
  33 #include <fcntl.h>
  34
  35 #ifdef HAVE_REGEX_H
  36 #include <regex.h>
  37
  38 /*
  39  *  For POSIX Regular expressions.
  40  *  (0) Means no extended regular expressions.
  41  *  REG_EXTENDED means use extended regular expressions.
  42  */
  43 #ifndef REG_EXTENDED
  44 #define REG_EXTENDED (0)
  45 #endif
  46
  47 #ifndef REG_NOSUB
  48 #define REG_NOSUB (0)
  49 #endif
  50
  51 #ifndef REG_ICASE
  52 #define REG_ICASE (0)
  53 #endif
  54 #endif
  55
  56 static rbtree_t *realms_byname = NULL;
  57
  58 #ifdef HAVE_REGEX_H
  59 typedef struct realm_regex_t {
  60         REALM   *realm;
  61         struct realm_regex_t *next;
  62 } realm_regex_t;
  63
  64 static realm_regex_t *realms_regex = NULL;
  65
  66 #endif /* HAVE_REGEX_H */
  67
  68 typedef struct realm_config_t {
  69         CONF_SECTION    *cs;
  70         int             dead_time;
  71         int             retry_count;
  72         int             retry_delay;
  73         int             fallback;
  74         int             wake_all_if_all_dead;
  75 } realm_config_t;
  76
  77 static realm_config_t *realm_config = NULL;
  78
  79 #ifdef WITH_PROXY
  80 static rbtree_t *home_servers_byaddr = NULL;
  81 static rbtree_t *home_servers_byname = NULL;
  82 #ifdef WITH_STATS
  83 static int home_server_max_number = 0;
  84 static rbtree_t *home_servers_bynumber = NULL;
  85 #endif
  86
  87 static rbtree_t *home_pools_byname = NULL;
  88
  89 /*
  90  *  Map the proxy server configuration parameters to variables.
  91  */
  92 static const CONF_PARSER proxy_config[] = {
  93         { "retry_delay",  PW_TYPE_INTEGER,
  94           offsetof(realm_config_t, retry_delay),
  95           NULL, Stringify(RETRY_DELAY) },
  96
  97         { "retry_count",  PW_TYPE_INTEGER,
  98           offsetof(realm_config_t, retry_count),
  99           NULL, Stringify(RETRY_COUNT) },
 100
 101         { "default_fallback", PW_TYPE_BOOLEAN,
 102           offsetof(realm_config_t, fallback),
 103           NULL, "no" },
 104
 105         { "dead_time",    PW_TYPE_INTEGER,
 106           offsetof(realm_config_t, dead_time),
 107           NULL, Stringify(DEAD_TIME) },
 108
 109         { "wake_all_if_all_dead", PW_TYPE_BOOLEAN,
 110           offsetof(realm_config_t, wake_all_if_all_dead),
 111           NULL, "no" },
 112
 113 #ifdef WITH_POST_PROXY_AUTHORIZE
 114         { "post_proxy_authorize", PW_TYPE_BOOLEAN, 0,
 115           &mainconfig.post_proxy_authorize, "yes" },
 116 #endif
 117
 118         { NULL, -1, 0, NULL, NULL }
 119 };
 120 #endif
 121
 122 static int realm_name_cmp(const void *one, const void *two)
 123 {
 124         const REALM *a = one;
 125         const REALM *b = two;
 126
 127         return strcasecmp(a->name, b->name);
 128 }
 129
 130
 131 #ifdef WITH_PROXY
 132 static int home_server_name_cmp(const void *one, const void *two)
 133 {
 134         const home_server *a = one;
 135         const home_server *b = two;
 136
 137         if (a->type < b->type) return -1;
 138         if (a->type > b->type) return +1;
 139
 140         return strcasecmp(a->name, b->name);
 141 }
 142
 143 static int home_server_addr_cmp(const void *one, const void *two)
 144 {
 145         const home_server *a = one;
 146         const home_server *b = two;
 147
 148         if (a->server && !b->server) return -1;
 149         if (!a->server && b->server) return +1;
 150         if (a->server && b->server) {
 151                 int rcode = a->type - b->type;
 152                 if (rcode != 0) return rcode;
 153                 return strcmp(a->server, b->server);
 154         }
 155
 156         if (a->port < b->port) return -1;
 157         if (a->port > b->port) return +1;
 158
 159         return fr_ipaddr_cmp(&a->ipaddr, &b->ipaddr);
 160 }
 161
 162 #ifdef WITH_STATS
 163 static int home_server_number_cmp(const void *one, const void *two)
 164 {
 165         const home_server *a = one;
 166         const home_server *b = two;
 167
 168         return (a->number - b->number);
 169 }
 170 #endif
 171
 172 static int home_pool_name_cmp(const void *one, const void *two)
 173 {
 174         const home_pool_t *a = one;
 175         const home_pool_t *b = two;
 176
 177         if (a->server_type < b->server_type) return -1;
 178         if (a->server_type > b->server_type) return +1;
 179
 180         return strcasecmp(a->name, b->name);
 181 }
 182
 183
 184 /*
 185  *      Xlat for %{home_server:foo}
 186  */
 187 static size_t xlat_home_server(UNUSED void *instance, REQUEST *request,
 188                                char *fmt, char *out, size_t outlen,
 189                                UNUSED RADIUS_ESCAPE_STRING func)
 190 {
 191         const char *value = NULL;
 192         CONF_PAIR *cp;
 193
 194         if (!fmt || !out || (outlen < 1)) return 0;
 195
 196         if (!request || !request->home_server) {
 197                 *out = '\0';
 198                 return 0;
 199         }
 200
 201         cp = cf_pair_find(request->home_server->cs, fmt);
 202         if (!cp || !(value = cf_pair_value(cp))) {
 203                 *out = '\0';
 204                 return 0;
 205         }
 206
 207         strlcpy(out, value, outlen);
 208
 209         return strlen(out);
 210 }
 211
 212
 213 /*
 214  *      Xlat for %{home_server_pool:foo}
 215  */
 216 static size_t xlat_server_pool(UNUSED void *instance, REQUEST *request,
 217                                char *fmt, char *out, size_t outlen,
 218                                UNUSED RADIUS_ESCAPE_STRING func)
 219 {
 220         const char *value = NULL;
 221         CONF_PAIR *cp;
 222
 223         if (!fmt || !out || (outlen < 1)) return 0;
 224
 225         if (!request || !request->home_pool) {
 226                 *out = '\0';
 227                 return 0;
 228         }
 229
 230         cp = cf_pair_find(request->home_pool->cs, fmt);
 231         if (!cp || !(value = cf_pair_value(cp))) {
 232                 *out = '\0';
 233                 return 0;
 234         }
 235
 236         strlcpy(out, value, outlen);
 237
 238         return strlen(out);
 239 }
 240 #endif
 241
 242 void realms_free(void)
 243 {
 244 #ifdef WITH_PROXY
 245 #ifdef WITH_STATS
 246         rbtree_free(home_servers_bynumber);
 247         home_servers_bynumber = NULL;
 248 #endif
 249
 250         rbtree_free(home_servers_byname);
 251         home_servers_byname = NULL;
 252
 253         rbtree_free(home_servers_byaddr);
 254         home_servers_byaddr = NULL;
 255
 256         rbtree_free(home_pools_byname);
 257         home_pools_byname = NULL;
 258 #endif
 259
 260         rbtree_free(realms_byname);
 261         realms_byname = NULL;
 262
 263 #ifdef HAVE_REGEX_H
 264         if (realms_regex) {
 265                 realm_regex_t *this, *next;
 266
 267                 for (this = realms_regex; this != NULL; this = next) {
 268                         next = this->next;
 269                         free(this->realm);
 270                         free(this);
 271                 }
 272                 realms_regex = NULL;
 273         }
 274 #endif
 275
 276         free(realm_config);
 277         realm_config = NULL;
 278 }
 279
 280
 281 #ifdef WITH_PROXY
 282 static struct in_addr hs_ip4addr;
 283 static struct in6_addr hs_ip6addr;
 284 static char *hs_srcipaddr = NULL;
 285 static char *hs_type = NULL;
 286 static char *hs_check = NULL;
 287 static char *hs_virtual_server = NULL;
 288
 289 static CONF_PARSER home_server_config[] = {
 290         { "ipaddr",  PW_TYPE_IPADDR,
 291           0, &hs_ip4addr,  NULL },
 292         { "ipv6addr",  PW_TYPE_IPV6ADDR,
 293           0, &hs_ip6addr, NULL },
 294         { "virtual_server",  PW_TYPE_STRING_PTR,
 295           0, &hs_virtual_server, NULL },
 296
 297         { "port", PW_TYPE_INTEGER,
 298           offsetof(home_server,port), NULL,   "0" },
 299
 300         { "type",  PW_TYPE_STRING_PTR,
 301           0, &hs_type, NULL },
 302
 303         { "secret",  PW_TYPE_STRING_PTR,
 304           offsetof(home_server,secret), NULL,  NULL},
 305
 306         { "src_ipaddr",  PW_TYPE_STRING_PTR,
 307           0, &hs_srcipaddr,  NULL },
 308
 309         { "response_window", PW_TYPE_INTEGER,
 310           offsetof(home_server,response_window), NULL,   "30" },
 311         { "no_response_fail", PW_TYPE_BOOLEAN,
 312           offsetof(home_server,no_response_fail), NULL,   NULL },
 313         { "max_outstanding", PW_TYPE_INTEGER,
 314           offsetof(home_server,max_outstanding), NULL,   "65536" },
 315         { "require_message_authenticator",  PW_TYPE_BOOLEAN,
 316           offsetof(home_server, message_authenticator), 0, NULL },
 317
 318         { "zombie_period", PW_TYPE_INTEGER,
 319           offsetof(home_server,zombie_period), NULL,   "40" },
 320         { "status_check", PW_TYPE_STRING_PTR,
 321           0, &hs_check,   "none" },
 322         { "ping_check", PW_TYPE_STRING_PTR,
 323           0, &hs_check,   NULL },
 324
 325         { "ping_interval", PW_TYPE_INTEGER,
 326           offsetof(home_server,ping_interval), NULL,   "30" },
 327         { "check_interval", PW_TYPE_INTEGER,
 328           offsetof(home_server,ping_interval), NULL,   "30" },
 329         { "num_answers_to_alive", PW_TYPE_INTEGER,
 330           offsetof(home_server,num_pings_to_alive), NULL,   "3" },
 331         { "num_pings_to_alive", PW_TYPE_INTEGER,
 332           offsetof(home_server,num_pings_to_alive), NULL,   "3" },
 333         { "revive_interval", PW_TYPE_INTEGER,
 334           offsetof(home_server,revive_interval), NULL,   "300" },
 335         { "status_check_timeout", PW_TYPE_INTEGER,
 336           offsetof(home_server,ping_timeout), NULL,   "4" },
 337
 338         { "username",  PW_TYPE_STRING_PTR,
 339           offsetof(home_server,ping_user_name), NULL,  NULL},
 340         { "password",  PW_TYPE_STRING_PTR,
 341           offsetof(home_server,ping_user_password), NULL,  NULL},
 342
 343 #ifdef WITH_STATS
 344         { "historic_average_window", PW_TYPE_INTEGER,
 345           offsetof(home_server,ema.window), NULL,  NULL },
 346 #endif
 347
 348 #ifdef WITH_COA
 349         { "irt",  PW_TYPE_INTEGER,
 350           offsetof(home_server, coa_irt), 0, Stringify(2) },
 351         { "mrt",  PW_TYPE_INTEGER,
 352           offsetof(home_server, coa_mrt), 0, Stringify(16) },
 353         { "mrc",  PW_TYPE_INTEGER,
 354           offsetof(home_server, coa_mrc), 0, Stringify(5) },
 355         { "mrd",  PW_TYPE_INTEGER,
 356           offsetof(home_server, coa_mrd), 0, Stringify(30) },
 357 #endif
 358
 359         { NULL, -1, 0, NULL, NULL }             /* end the list */
 360 };
 361
 362
 363 static void null_free(UNUSED void *data)
 364 {
 365 }
 366
 367 static int home_server_add(realm_config_t *rc, CONF_SECTION *cs)
 368 {
 369         const char *name2;
 370         home_server *home;
 371         int dual = FALSE;
 372         CONF_PAIR *cp;
 373
 374         free(hs_virtual_server); /* used only for printing during parsing */
 375         hs_virtual_server = NULL;
 376
 377         name2 = cf_section_name2(cs);
 378         if (!name2) {
 379                 cf_log_err(cf_sectiontoitem(cs),
 380                            "Home server section is missing a name.");
 381                 return 0;
 382         }
 383
 384         home = rad_malloc(sizeof(*home));
 385         memset(home, 0, sizeof(*home));
 386
 387         home->name = name2;
 388         home->cs = cs;
 389
 390         /*
 391          *      For zombie period calculations.  We want to count
 392          *      zombies from the time when the server starts, instead
 393          *      of from 1970.
 394          */
 395         home->last_packet = time(NULL);
 396
 397         /*
 398          *      Authentication servers have a default "no_response_fail = 0".
 399          *      Accounting servers have a default "no_response_fail = 1".
 400          *
 401          *      This is because authentication packets are retried, so
 402          *      they can fail over to another home server.  Accounting
 403          *      packets are not retried, so they cannot fail over, and
 404          *      instead should be rejected immediately.
 405          */
 406         home->no_response_fail = 2;
 407
 408         memset(&hs_ip4addr, 0, sizeof(hs_ip4addr));
 409         memset(&hs_ip6addr, 0, sizeof(hs_ip6addr));
 410         if (cf_section_parse(cs, home, home_server_config) < 0) {
 411                 free(home);
 412                 return 0;
 413         }
 414
 415         /*
 416          *      Figure out which one to use.
 417          */
 418         if (cf_pair_find(cs, "ipaddr")) {
 419                 home->ipaddr.af = AF_INET;
 420                 home->ipaddr.ipaddr.ip4addr = hs_ip4addr;
 421
 422         } else if (cf_pair_find(cs, "ipv6addr")) {
 423                 home->ipaddr.af = AF_INET6;
 424                 home->ipaddr.ipaddr.ip6addr = hs_ip6addr;
 425
 426         } else if ((cp = cf_pair_find(cs, "virtual_server")) != NULL) {
 427                 home->ipaddr.af = AF_UNSPEC;
 428                 home->server = cf_pair_value(cp);
 429                 if (!home->server) {
 430                         cf_log_err(cf_sectiontoitem(cs),
 431                                    "Invalid value for virtual_server");
 432                         goto error;
 433                 }
 434
 435                 if (!cf_section_sub_find_name2(rc->cs, "server", home->server)) {
 436
 437                         cf_log_err(cf_sectiontoitem(cs),
 438                                    "No such server %s", home->server);
 439                         goto error;
 440                 }
 441
 442                 /*
 443                  *      When CoA is used, the user has to specify the type
 444                  *      of the home server, even when they point to
 445                  *      virtual servers.
 446                  */
 447                 home->secret = strdup("");
 448                 goto skip_port;
 449
 450         } else {
 451                 cf_log_err(cf_sectiontoitem(cs),
 452                            "No ipaddr, ipv6addr, or virtual_server defined for home server \"%s\".",
 453                            name2);
 454         error:
 455                 free(home);
 456                 free(hs_type);
 457                 hs_type = NULL;
 458                 free(hs_check);
 459                 hs_check = NULL;
 460                 free(hs_srcipaddr);
 461                 hs_srcipaddr = NULL;
 462                 return 0;
 463         }
 464
 465         if (!home->port || (home->port > 65535)) {
 466                 cf_log_err(cf_sectiontoitem(cs),
 467                            "No port, or invalid port defined for home server %s.",
 468                            name2);
 469                 goto error;
 470         }
 471
 472         if (0) {
 473                 cf_log_err(cf_sectiontoitem(cs),
 474                            "Fatal error!  Home server %s is ourselves!",
 475                            name2);
 476                 goto error;
 477         }
 478
 479         if (!home->secret) {
 480                 cf_log_err(cf_sectiontoitem(cs),
 481                            "No shared secret defined for home server %s.",
 482                            name2);
 483                 goto error;
 484         }
 485
 486         /*
 487          *      Use a reasonable default.
 488          */
 489  skip_port:
 490         if (!hs_type) hs_type = strdup("auth+acct");
 491
 492         if (strcasecmp(hs_type, "auth") == 0) {
 493                 home->type = HOME_TYPE_AUTH;
 494                 if (home->no_response_fail == 2) home->no_response_fail = 0;
 495
 496         } else if (strcasecmp(hs_type, "acct") == 0) {
 497                 home->type = HOME_TYPE_ACCT;
 498                 if (home->no_response_fail == 2) home->no_response_fail = 1;
 499
 500         } else if (strcasecmp(hs_type, "auth+acct") == 0) {
 501                 home->type = HOME_TYPE_AUTH;
 502                 dual = TRUE;
 503
 504 #ifdef WITH_COA
 505         } else if (strcasecmp(hs_type, "coa") == 0) {
 506                 home->type = HOME_TYPE_COA;
 507                 dual = FALSE;
 508
 509                 if (home->server != NULL) {
 510                         cf_log_err(cf_sectiontoitem(cs),
 511                                    "Home servers of type \"coa\" cannot point to a virtual server");
 512                         goto error;
 513                 }
 514 #endif
 515
 516         } else {
 517                 cf_log_err(cf_sectiontoitem(cs),
 518                            "Invalid type \"%s\" for home server %s.",
 519                            hs_type, name2);
 520                 goto error;
 521         }
 522         free(hs_type);
 523         hs_type = NULL;
 524
 525         if (!hs_check || (strcasecmp(hs_check, "none") == 0)) {
 526                 home->ping_check = HOME_PING_CHECK_NONE;
 527
 528         } else if (strcasecmp(hs_check, "status-server") == 0) {
 529                 home->ping_check = HOME_PING_CHECK_STATUS_SERVER;
 530
 531         } else if (strcasecmp(hs_check, "request") == 0) {
 532                 home->ping_check = HOME_PING_CHECK_REQUEST;
 533
 534         } else {
 535                 cf_log_err(cf_sectiontoitem(cs),
 536                            "Invalid ping_check \"%s\" for home server %s.",
 537                            hs_check, name2);
 538                 goto error;
 539         }
 540         free(hs_check);
 541         hs_check = NULL;
 542
 543         if ((home->ping_check != HOME_PING_CHECK_NONE) &&
 544             (home->ping_check != HOME_PING_CHECK_STATUS_SERVER)) {
 545                 if (!home->ping_user_name) {
 546                         cf_log_err(cf_sectiontoitem(cs), "You must supply a user name to enable ping checks");
 547                         goto error;
 548                 }
 549
 550                 if ((home->type == HOME_TYPE_AUTH) &&
 551                     !home->ping_user_password) {
 552                         cf_log_err(cf_sectiontoitem(cs), "You must supply a password to enable ping checks");
 553                         goto error;
 554                 }
 555         }
 556
 557         if ((home->ipaddr.af != AF_UNSPEC) && /* could be virtual server */
 558             rbtree_finddata(home_servers_byaddr, home)) {
 559                 cf_log_err(cf_sectiontoitem(cs), "Duplicate home server");
 560                 goto error;
 561         }
 562
 563         /*
 564          *      Look up the name using the *same* address family as
 565          *      for the home server.
 566          */
 567         if (hs_srcipaddr && (home->ipaddr.af != AF_UNSPEC)) {
 568                 if (ip_hton(hs_srcipaddr, home->ipaddr.af, &home->src_ipaddr) < 0) {
 569                         cf_log_err(cf_sectiontoitem(cs), "Failed parsing src_ipaddr");
 570                         goto error;
 571                 }
 572         }
 573
 574         /*
 575          *      Make sure that this is set.
 576          */
 577         if (home->src_ipaddr.af == AF_UNSPEC) {
 578                 home->src_ipaddr.af = home->ipaddr.af;
 579         }
 580
 581         free(hs_srcipaddr);
 582         hs_srcipaddr = NULL;
 583
 584         if (!rbtree_insert(home_servers_byname, home)) {
 585                 cf_log_err(cf_sectiontoitem(cs),
 586                            "Internal error %d adding home server %s.",
 587                            __LINE__, name2);
 588                 goto error;
 589         }
 590
 591         if ((home->ipaddr.af != AF_UNSPEC) && /* could be virtual server */
 592             !rbtree_insert(home_servers_byaddr, home)) {
 593                 rbtree_deletebydata(home_servers_byname, home);
 594                 cf_log_err(cf_sectiontoitem(cs),
 595                            "Internal error %d adding home server %s.",
 596                            __LINE__, name2);
 597                 goto error;
 598         }
 599
 600 #ifdef WITH_STATS
 601         home->number = home_server_max_number++;
 602         if (!rbtree_insert(home_servers_bynumber, home)) {
 603                 rbtree_deletebydata(home_servers_byname, home);
 604                 if (home->ipaddr.af != AF_UNSPEC) {
 605                         rbtree_deletebydata(home_servers_byname, home);
 606                 }
 607                 cf_log_err(cf_sectiontoitem(cs),
 608                            "Internal error %d adding home server %s.",
 609                            __LINE__, name2);
 610                 goto error;
 611         }
 612 #endif
 613
 614         if (home->max_outstanding < 8) home->max_outstanding = 8;
 615         if (home->max_outstanding > 65536*16) home->max_outstanding = 65536*16;
 616
 617         if (home->ping_interval < 6) home->ping_interval = 6;
 618         if (home->ping_interval > 120) home->ping_interval = 120;
 619
 620         if (home->response_window < 1) home->response_window = 1;
 621         if (home->response_window > 60) home->response_window = 60;
 622
 623         if (home->zombie_period < 1) home->zombie_period = 1;
 624         if (home->zombie_period > 120) home->zombie_period = 120;
 625
 626         if (home->zombie_period < home->response_window) {
 627                 home->zombie_period = home->response_window;
 628         }
 629
 630         if (home->num_pings_to_alive < 3) home->num_pings_to_alive = 3;
 631         if (home->num_pings_to_alive > 10) home->num_pings_to_alive = 10;
 632
 633         if (home->ping_timeout < 3) home->ping_timeout = 3;
 634         if (home->ping_timeout > 10) home->ping_timeout = 10;
 635
 636         if (home->revive_interval < 60) home->revive_interval = 60;
 637         if (home->revive_interval > 3600) home->revive_interval = 3600;
 638
 639 #ifdef WITH_COA
 640         if (home->coa_irt < 1) home->coa_irt = 1;
 641         if (home->coa_irt > 5) home->coa_irt = 5;
 642
 643         if (home->coa_mrc < 0) home->coa_mrc = 0;
 644         if (home->coa_mrc > 20 ) home->coa_mrc = 20;
 645
 646         if (home->coa_mrt < 0) home->coa_mrt = 0;
 647         if (home->coa_mrt > 30 ) home->coa_mrt = 30;
 648
 649         if (home->coa_mrd < 5) home->coa_mrd = 5;
 650         if (home->coa_mrd > 60 ) home->coa_mrd = 60;
 651 #endif
 652
 653         if (dual) {
 654                 home_server *home2 = rad_malloc(sizeof(*home2));
 655
 656                 memcpy(home2, home, sizeof(*home2));
 657
 658                 home2->type = HOME_TYPE_ACCT;
 659                 home2->port++;
 660                 home2->ping_user_password = NULL;
 661                 home2->cs = cs;
 662
 663                 if (home->no_response_fail == 2) home->no_response_fail = 0;
 664                 if (home2->no_response_fail == 2) home2->no_response_fail = 1;
 665
 666                 if (!rbtree_insert(home_servers_byname, home2)) {
 667                         cf_log_err(cf_sectiontoitem(cs),
 668                                    "Internal error %d adding home server %s.",
 669                                    __LINE__, name2);
 670                         free(home2);
 671                         return 0;
 672                 }
 673
 674                 if ((home->ipaddr.af != AF_UNSPEC) &&
 675                     !rbtree_insert(home_servers_byaddr, home2)) {
 676                         rbtree_deletebydata(home_servers_byname, home2);
 677                         cf_log_err(cf_sectiontoitem(cs),
 678                                    "Internal error %d adding home server %s.",
 679                                    __LINE__, name2);
 680                         free(home2);
 681                         return 0;
 682                 }
 683
 684 #ifdef WITH_STATS
 685                 home2->number = home_server_max_number++;
 686                 if (!rbtree_insert(home_servers_bynumber, home2)) {
 687                         rbtree_deletebydata(home_servers_byname, home2);
 688                         if (home2->ipaddr.af != AF_UNSPEC) {
 689                                 rbtree_deletebydata(home_servers_byname, home2);
 690                         }
 691                         cf_log_err(cf_sectiontoitem(cs),
 692                                    "Internal error %d adding home server %s.",
 693                                    __LINE__, name2);
 694                         free(home2);
 695                         return 0;
 696                 }
 697 #endif
 698         }
 699
 700         /*
 701          *      Mark it as already processed
 702          */
 703         cf_data_add(cs, "home_server", null_free, null_free);
 704
 705         return 1;
 706 }
 707
 708
 709 static home_pool_t *server_pool_alloc(const char *name, home_pool_type_t type,
 710                                       int server_type, int num_home_servers)
 711 {
 712         home_pool_t *pool;
 713
 714         pool = rad_malloc(sizeof(*pool) + (sizeof(pool->servers[0]) *
 715                                            num_home_servers));
 716         if (!pool) return NULL; /* just for pairanoia */
 717
 718         memset(pool, 0, sizeof(*pool) + (sizeof(pool->servers[0]) *
 719                                          num_home_servers));
 720
 721         pool->name = name;
 722         pool->type = type;
 723         pool->server_type = server_type;
 724         pool->num_home_servers = num_home_servers;
 725
 726         return pool;
 727 }
 728
 729 static int pool_check_home_server(realm_config_t *rc, CONF_PAIR *cp,
 730                                   const char *name, int server_type,
 731                                   home_server **phome)
 732 {
 733         home_server myhome, *home;
 734         CONF_SECTION *server_cs;
 735
 736         if (!name) {
 737                 cf_log_err(cf_pairtoitem(cp),
 738                            "No value given for home_server.");
 739                 return 0;
 740         }
 741
 742         myhome.name = name;
 743         myhome.type = server_type;
 744         home = rbtree_finddata(home_servers_byname, &myhome);
 745         if (home) {
 746                 *phome = home;
 747                 return 1;
 748         }
 749
 750         server_cs = cf_section_sub_find_name2(rc->cs, "home_server", name);
 751         if (!server_cs) {
 752                 cf_log_err(cf_pairtoitem(cp),
 753                            "Unknown home_server \"%s\".", name);
 754                 return 0;
 755         }
 756
 757         home = rbtree_finddata(home_servers_byname, &myhome);
 758         if (!home) {
 759                 return 0;
 760         }
 761
 762         *phome = home;
 763         return 1;
 764 }
 765
 766
 767 static int server_pool_add(realm_config_t *rc,
 768                            CONF_SECTION *cs, int server_type, int do_print)
 769 {
 770         const char *name2;
 771         home_pool_t *pool = NULL;
 772         const char *value;
 773         CONF_PAIR *cp;
 774         int num_home_servers;
 775         home_server *home;
 776
 777         name2 = cf_section_name1(cs);
 778         if (!name2 || ((strcasecmp(name2, "server_pool") != 0) &&
 779                        (strcasecmp(name2, "home_server_pool") != 0))) {
 780                 cf_log_err(cf_sectiontoitem(cs),
 781                            "Section is not a home_server_pool.");
 782                 return 0;
 783         }
 784
 785         name2 = cf_section_name2(cs);
 786         if (!name2) {
 787                 cf_log_err(cf_sectiontoitem(cs),
 788                            "Server pool section is missing a name.");
 789                 return 0;
 790         }
 791
 792         /*
 793          *      Count the home servers and initalize them.
 794          */
 795         num_home_servers = 0;
 796         for (cp = cf_pair_find(cs, "home_server");
 797              cp != NULL;
 798              cp = cf_pair_find_next(cs, cp, "home_server")) {
 799                 num_home_servers++;
 800
 801                 if (!pool_check_home_server(rc, cp, cf_pair_value(cp),
 802                                             server_type, &home)) {
 803
 804                         return 0;
 805                 }
 806         }
 807
 808         if (num_home_servers == 0) {
 809                 cf_log_err(cf_sectiontoitem(cs),
 810                            "No home servers defined in pool %s",
 811                            name2);
 812                 goto error;
 813         }
 814
 815         pool = server_pool_alloc(name2, HOME_POOL_FAIL_OVER, server_type,
 816                                  num_home_servers);
 817         pool->cs = cs;
 818
 819
 820         /*
 821          *      Fallback servers must be defined, and must be
 822          *      virtual servers.
 823          */
 824         cp = cf_pair_find(cs, "fallback");
 825         if (cp) {
 826 #ifdef WITH_COA
 827                 if (server_type == HOME_TYPE_COA) {
 828                         cf_log_err(cf_sectiontoitem(cs), "Home server pools of type \"coa\" cannot have a fallback virtual server.");
 829                         goto error;
 830                 }
 831 #endif
 832
 833                 if (!pool_check_home_server(rc, cp, cf_pair_value(cp),
 834                                             server_type, &pool->fallback)) {
 835
 836                         goto error;
 837                 }
 838
 839                 if (!pool->fallback->server) {
 840                         cf_log_err(cf_sectiontoitem(cs), "Fallback home_server %s does NOT contain a virtual_server directive.", pool->fallback->name);
 841                         goto error;
 842                 }
 843         }
 844
 845         if (do_print) cf_log_info(cs, " home_server_pool %s {", name2);
 846
 847         cp = cf_pair_find(cs, "type");
 848         if (cp) {
 849                 static FR_NAME_NUMBER pool_types[] = {
 850                         { "load-balance", HOME_POOL_LOAD_BALANCE },
 851                         { "fail-over", HOME_POOL_FAIL_OVER },
 852                         { "round_robin", HOME_POOL_LOAD_BALANCE },
 853                         { "fail_over", HOME_POOL_FAIL_OVER },
 854                         { "client-balance", HOME_POOL_CLIENT_BALANCE },
 855                         { "client-port-balance", HOME_POOL_CLIENT_PORT_BALANCE },
 856                         { "keyed-balance", HOME_POOL_KEYED_BALANCE },
 857                         { NULL, 0 }
 858                 };
 859
 860                 value = cf_pair_value(cp);
 861                 if (!value) {
 862                         cf_log_err(cf_pairtoitem(cp),
 863                                    "No value given for type.");
 864                         goto error;
 865                 }
 866
 867                 pool->type = fr_str2int(pool_types, value, 0);
 868                 if (!pool->type) {
 869                         cf_log_err(cf_pairtoitem(cp),
 870                                    "Unknown type \"%s\".",
 871                                    value);
 872                         goto error;
 873                 }
 874
 875                 if (do_print) cf_log_info(cs, "\ttype = %s", value);
 876         }
 877
 878         cp = cf_pair_find(cs, "virtual_server");
 879         if (cp) {
 880                 pool->virtual_server = cf_pair_value(cp);
 881                 if (!pool->virtual_server) {
 882                         cf_log_err(cf_pairtoitem(cp), "No value given for virtual_server");
 883                         goto error;
 884                 }
 885
 886                 if (do_print) {
 887                         cf_log_info(cs, "\tvirtual_server = %s", pool->virtual_server);
 888                 }
 889
 890                 if (!cf_section_sub_find_name2(rc->cs, "server",
 891                                                pool->virtual_server)) {
 892                         cf_log_err(cf_pairtoitem(cp), "No such server %s",
 893                                    pool->virtual_server);
 894                         goto error;
 895                 }
 896
 897         }
 898
 899         num_home_servers = 0;
 900         for (cp = cf_pair_find(cs, "home_server");
 901              cp != NULL;
 902              cp = cf_pair_find_next(cs, cp, "home_server")) {
 903                 home_server myhome;
 904
 905                 value = cf_pair_value(cp);
 906
 907                 memset(&myhome, 0, sizeof(&myhome));
 908                 myhome.name = value;
 909                 myhome.type = server_type;
 910
 911                 home = rbtree_finddata(home_servers_byname, &myhome);
 912                 if (!home) {
 913                         DEBUG2("Internal sanity check failed");
 914                         goto error;
 915                 }
 916
 917                 if (0) {
 918                         DEBUG2("Warning: Duplicate home server %s in server pool %s", home->name, pool->name);
 919                         continue;
 920                 }
 921
 922                 if (do_print) cf_log_info(cs, "\thome_server = %s", home->name);
 923                 pool->servers[num_home_servers++] = home;
 924         } /* loop over home_server's */
 925
 926         if (pool->fallback && do_print) {
 927                 cf_log_info(cs, "\tfallback = %s", pool->fallback->name);
 928         }
 929
 930         if (!rbtree_insert(home_pools_byname, pool)) {
 931                 rad_assert("Internal sanity check failed");
 932                 goto error;
 933         }
 934
 935         if (do_print) cf_log_info(cs, " }");
 936
 937         cf_data_add(cs, "home_server_pool", pool, free);
 938
 939         rad_assert(pool->server_type != 0);
 940
 941         return 1;
 942
 943  error:
 944         if (do_print) cf_log_info(cs, " }");
 945         free(pool);
 946         return 0;
 947 }
 948 #endif
 949
 950 static int old_server_add(realm_config_t *rc, CONF_SECTION *cs,
 951                           const char *realm,
 952                           const char *name, const char *secret,
 953                           home_pool_type_t ldflag, home_pool_t **pool_p,
 954                           int type, const char *server)
 955 {
 956 #ifdef WITH_PROXY
 957         int i, insert_point, num_home_servers;
 958         home_server myhome, *home;
 959         home_pool_t mypool, *pool;
 960         CONF_SECTION *subcs;
 961 #else
 962         rc = rc;                /* -Wunused */
 963         realm = realm;
 964         secret = secret;
 965         ldflag = ldflag;
 966         type = type;
 967         server = server;
 968 #endif
 969
 970         /*
 971          *      LOCAL realms get sanity checked, and nothing else happens.
 972          */
 973         if (strcmp(name, "LOCAL") == 0) {
 974                 if (*pool_p) {
 975                         cf_log_err(cf_sectiontoitem(cs), "Realm \"%s\" cannot be both LOCAL and remote", name);
 976                         return 0;
 977                 }
 978                 return 1;
 979         }
 980
 981 #ifndef WITH_PROXY
 982         return 0;               /* Not proxying.  Can't do non-LOCAL realms */
 983
 984 #else
 985         mypool.name = realm;
 986         mypool.server_type = type;
 987         pool = rbtree_finddata(home_pools_byname, &mypool);
 988         if (pool) {
 989                 if (pool->type != ldflag) {
 990                         cf_log_err(cf_sectiontoitem(cs), "Inconsistent ldflag for server pool \"%s\"", name);
 991                         return 0;
 992                 }
 993
 994                 if (pool->server_type != type) {
 995                         cf_log_err(cf_sectiontoitem(cs), "Inconsistent home server type for server pool \"%s\"", name);
 996                         return 0;
 997                 }
 998         }
 999
1000         myhome.name = name;
1001         myhome.type = type;
1002         home = rbtree_finddata(home_servers_byname, &myhome);
1003         if (home) {
1004                 if (secret && (strcmp(home->secret, secret) != 0)) {
1005                         cf_log_err(cf_sectiontoitem(cs), "Inconsistent shared secret for home server \"%s\"", name);
1006                         return 0;
1007                 }
1008
1009                 if (home->type != type) {
1010                         cf_log_err(cf_sectiontoitem(cs), "Inconsistent type for home server \"%s\"", name);
1011                         return 0;
1012                 }
1013
1014                 /*
1015                  *      See if the home server is already listed
1016                  *      in the pool.  If so, do nothing else.
1017                  */
1018                 if (pool) for (i = 0; i < pool->num_home_servers; i++) {
1019                         if (pool->servers[i] == home) {
1020                                 return 1;
1021                         }
1022                 }
1023         }
1024
1025         /*
1026          *      If we do have a pool, check that there is room to
1027          *      insert the home server we've found, or the one that we
1028          *      create here.
1029          *
1030          *      Note that we insert it into the LAST available
1031          *      position, in order to maintain the same order as in
1032          *      the configuration files.
1033          */
1034         insert_point = -1;
1035         if (pool) {
1036                 for (i = pool->num_home_servers - 1; i >= 0; i--) {
1037                         if (pool->servers[i]) break;
1038
1039                         if (!pool->servers[i]) {
1040                                 insert_point = i;
1041                         }
1042                 }
1043
1044                 if (insert_point < 0) {
1045                         cf_log_err(cf_sectiontoitem(cs), "No room in pool to add home server \"%s\".  Please update the realm configuration to use the new-style home servers and server pools.", name);
1046                         return 0;
1047                 }
1048         }
1049
1050         /*
1051          *      No home server, allocate one.
1052          */
1053         if (!home) {
1054                 const char *p;
1055                 char *q;
1056
1057                 home = rad_malloc(sizeof(*home));
1058                 memset(home, 0, sizeof(*home));
1059
1060                 home->name = name;
1061                 home->hostname = name;
1062                 home->type = type;
1063                 home->secret = secret;
1064                 home->cs = cs;
1065
1066                 p = strchr(name, ':');
1067                 if (!p) {
1068                         if (type == HOME_TYPE_AUTH) {
1069                                 home->port = PW_AUTH_UDP_PORT;
1070                         } else {
1071                                 home->port = PW_ACCT_UDP_PORT;
1072                         }
1073
1074                         p = name;
1075                         q = NULL;
1076
1077                 } else if (p == name) {
1078                                 cf_log_err(cf_sectiontoitem(cs),
1079                                            "Invalid hostname %s.",
1080                                            name);
1081                                 free(home);
1082                                 return 0;
1083
1084                 } else {
1085                         home->port = atoi(p + 1);
1086                         if ((home->port == 0) || (home->port > 65535)) {
1087                                 cf_log_err(cf_sectiontoitem(cs),
1088                                            "Invalid port %s.",
1089                                            p + 1);
1090                                 free(home);
1091                                 return 0;
1092                         }
1093
1094                         q = rad_malloc((p - name) + 1);
1095                         memcpy(q, name, (p - name));
1096                         q[p - name] = '\0';
1097                         p = q;
1098                 }
1099
1100                 if (!server) {
1101                         if (ip_hton(p, AF_UNSPEC, &home->ipaddr) < 0) {
1102                                 cf_log_err(cf_sectiontoitem(cs),
1103                                            "Failed looking up hostname %s.",
1104                                            p);
1105                                 free(home);
1106                                 free(q);
1107                                 return 0;
1108                         }
1109                 } else {
1110                         home->ipaddr.af = AF_UNSPEC;
1111                         home->server = server;
1112                 }
1113                 free(q);
1114
1115                 /*
1116                  *      Use the old-style configuration.
1117                  */
1118                 home->max_outstanding = 65535*16;
1119                 home->zombie_period = rc->retry_delay * rc->retry_count;
1120                 if (home->zombie_period == 0) home->zombie_period =30;
1121                 home->response_window = home->zombie_period - 1;
1122
1123                 home->ping_check = HOME_PING_CHECK_NONE;
1124
1125                 home->revive_interval = rc->dead_time;
1126
1127                 if (rbtree_finddata(home_servers_byaddr, home)) {
1128                         cf_log_err(cf_sectiontoitem(cs), "Home server %s has the same IP address and/or port as another home server.", name);
1129                         free(home);
1130                         return 0;
1131                 }
1132
1133                 if (!rbtree_insert(home_servers_byname, home)) {
1134                         cf_log_err(cf_sectiontoitem(cs), "Internal error %d adding home server %s.", __LINE__, name);
1135                         free(home);
1136                         return 0;
1137                 }
1138
1139                 if (!rbtree_insert(home_servers_byaddr, home)) {
1140                         rbtree_deletebydata(home_servers_byname, home);
1141                         cf_log_err(cf_sectiontoitem(cs), "Internal error %d adding home server %s.", __LINE__, name);
1142                         free(home);
1143                         return 0;
1144                 }
1145
1146 #ifdef WITH_STATS
1147                 home->number = home_server_max_number++;
1148                 if (!rbtree_insert(home_servers_bynumber, home)) {
1149                         rbtree_deletebydata(home_servers_byname, home);
1150                         if (home->ipaddr.af != AF_UNSPEC) {
1151                                 rbtree_deletebydata(home_servers_byname, home);
1152                         }
1153                         cf_log_err(cf_sectiontoitem(cs),
1154                                    "Internal error %d adding home server %s.",
1155                                    __LINE__, name);
1156                         free(home);
1157                         return 0;
1158                 }
1159 #endif
1160         }
1161
1162         /*
1163          *      We now have a home server, see if we can insert it
1164          *      into pre-existing pool.
1165          */
1166         if (insert_point >= 0) {
1167                 rad_assert(pool != NULL);
1168                 pool->servers[insert_point] = home;
1169                 return 1;
1170         }
1171
1172         rad_assert(pool == NULL);
1173         rad_assert(home != NULL);
1174
1175         /*
1176          *      Count the old-style realms of this name.
1177          */
1178         num_home_servers = 0;
1179         for (subcs = cf_section_find_next(cs, NULL, "realm");
1180              subcs != NULL;
1181              subcs = cf_section_find_next(cs, subcs, "realm")) {
1182                 const char *this = cf_section_name2(subcs);
1183
1184                 if (!this || (strcmp(this, realm) != 0)) continue;
1185                 num_home_servers++;
1186         }
1187
1188         if (num_home_servers == 0) {
1189                 cf_log_err(cf_sectiontoitem(cs), "Internal error counting pools for home server %s.", name);
1190                 free(home);
1191                 return 0;
1192         }
1193
1194         pool = server_pool_alloc(realm, ldflag, type, num_home_servers);
1195         pool->cs = cs;
1196
1197         pool->servers[0] = home;
1198
1199         if (!rbtree_insert(home_pools_byname, pool)) {
1200                 rad_assert("Internal sanity check failed");
1201                 return 0;
1202         }
1203
1204         *pool_p = pool;
1205
1206         return 1;
1207 #endif
1208 }
1209
1210 static int old_realm_config(realm_config_t *rc, CONF_SECTION *cs, REALM *r)
1211 {
1212         const char *host;
1213         const char *secret = NULL;
1214         home_pool_type_t ldflag;
1215         CONF_PAIR *cp;
1216
1217         cp = cf_pair_find(cs, "ldflag");
1218         ldflag = HOME_POOL_FAIL_OVER;
1219         if (cp) {
1220                 host = cf_pair_value(cp);
1221                 if (!host) {
1222                         cf_log_err(cf_pairtoitem(cp), "No value specified for ldflag");
1223                         return 0;
1224                 }
1225
1226                 if (strcasecmp(host, "fail_over") == 0) {
1227                         cf_log_info(cs, "\tldflag = fail_over");
1228
1229                 } else if (strcasecmp(host, "round_robin") == 0) {
1230                         ldflag = HOME_POOL_LOAD_BALANCE;
1231                         cf_log_info(cs, "\tldflag = round_robin");
1232
1233                 } else {
1234                         cf_log_err(cf_sectiontoitem(cs), "Unknown value \"%s\" for ldflag", host);
1235                         return 0;
1236                 }
1237         } /* else don't print it. */
1238
1239         /*
1240          *      Allow old-style if it doesn't exist, or if it exists and
1241          *      it's LOCAL.
1242          */
1243         cp = cf_pair_find(cs, "authhost");
1244         if (cp) {
1245                 host = cf_pair_value(cp);
1246                 if (!host) {
1247                         cf_log_err(cf_pairtoitem(cp), "No value specified for authhost");
1248                         return 0;
1249                 }
1250
1251                 if (strcmp(host, "LOCAL") != 0) {
1252                         cp = cf_pair_find(cs, "secret");
1253                         if (!cp) {
1254                                 cf_log_err(cf_sectiontoitem(cs), "No shared secret supplied for realm: %s", r->name);
1255                                 return 0;
1256                         }
1257
1258                         secret = cf_pair_value(cp);
1259                         if (!secret) {
1260                                 cf_log_err(cf_pairtoitem(cp), "No value specified for secret");
1261                                 return 0;
1262                         }
1263                 }
1264
1265                 cf_log_info(cs, "\tauthhost = %s",  host);
1266
1267                 if (!old_server_add(rc, cs, r->name, host, secret, ldflag,
1268                                     &r->auth_pool, HOME_TYPE_AUTH, NULL)) {
1269                         return 0;
1270                 }
1271         }
1272
1273         cp = cf_pair_find(cs, "accthost");
1274         if (cp) {
1275                 host = cf_pair_value(cp);
1276                 if (!host) {
1277                         cf_log_err(cf_pairtoitem(cp), "No value specified for accthost");
1278                         return 0;
1279                 }
1280
1281                 /*
1282                  *      Don't look for a secret again if it was found
1283                  *      above.
1284                  */
1285                 if ((strcmp(host, "LOCAL") != 0) && !secret) {
1286                         cp = cf_pair_find(cs, "secret");
1287                         if (!cp) {
1288                                 cf_log_err(cf_sectiontoitem(cs), "No shared secret supplied for realm: %s", r->name);
1289                                 return 0;
1290                         }
1291
1292                         secret = cf_pair_value(cp);
1293                         if (!secret) {
1294                                 cf_log_err(cf_pairtoitem(cp), "No value specified for secret");
1295                                 return 0;
1296                         }
1297                 }
1298
1299                 cf_log_info(cs, "\taccthost = %s", host);
1300
1301                 if (!old_server_add(rc, cs, r->name, host, secret, ldflag,
1302                                     &r->acct_pool, HOME_TYPE_ACCT, NULL)) {
1303                         return 0;
1304                 }
1305         }
1306
1307         cp = cf_pair_find(cs, "virtual_server");
1308         if (cp) {
1309                 host = cf_pair_value(cp);
1310                 if (!host) {
1311                         cf_log_err(cf_pairtoitem(cp), "No value specified for virtual_server");
1312                         return 0;
1313                 }
1314
1315                 cf_log_info(cs, "\tvirtual_server = %s", host);
1316
1317                 if (!old_server_add(rc, cs, r->name, host, "", ldflag,
1318                                     &r->auth_pool, HOME_TYPE_AUTH, host)) {
1319                         return 0;
1320                 }
1321                 if (!old_server_add(rc, cs, r->name, host, "", ldflag,
1322                                     &r->acct_pool, HOME_TYPE_ACCT, host)) {
1323                         return 0;
1324                 }
1325         }
1326
1327         if (secret) cf_log_info(cs, "\tsecret = %s", secret);
1328
1329         return 1;
1330
1331 }
1332
1333
1334 #ifdef WITH_PROXY
1335 static int add_pool_to_realm(realm_config_t *rc, CONF_SECTION *cs,
1336                              const char *name, home_pool_t **dest,
1337                              int server_type, int do_print)
1338 {
1339         home_pool_t mypool, *pool;
1340
1341         mypool.name = name;
1342         mypool.server_type = server_type;
1343
1344         pool = rbtree_finddata(home_pools_byname, &mypool);
1345         if (!pool) {
1346                 CONF_SECTION *pool_cs;
1347
1348                 pool_cs = cf_section_sub_find_name2(rc->cs,
1349                                                     "home_server_pool",
1350                                                     name);
1351                 if (!pool_cs) {
1352                         pool_cs = cf_section_sub_find_name2(rc->cs,
1353                                                             "server_pool",
1354                                                             name);
1355                 }
1356                 if (!pool_cs) {
1357                         cf_log_err(cf_sectiontoitem(cs), "Failed to find home_server_pool \"%s\"", name);
1358                         return 0;
1359                 }
1360
1361                 if (!server_pool_add(rc, pool_cs, server_type, do_print)) {
1362                         return 0;
1363                 }
1364
1365                 pool = rbtree_finddata(home_pools_byname, &mypool);
1366                 if (!pool) {
1367                         radlog(L_ERR, "Internal sanity check failed in add_pool_to_realm");
1368                         return 0;
1369                 }
1370         }
1371
1372         if (pool->server_type != server_type) {
1373                 cf_log_err(cf_sectiontoitem(cs), "Incompatible home_server_pool \"%s\" (mixed auth_pool / acct_pool)", name);
1374                 return 0;
1375         }
1376
1377         *dest = pool;
1378
1379         return 1;
1380 }
1381 #endif
1382
1383
1384 static int realm_add(realm_config_t *rc, CONF_SECTION *cs)
1385 {
1386         const char *name2;
1387         REALM *r = NULL;
1388         CONF_PAIR *cp;
1389 #ifdef WITH_PROXY
1390         home_pool_t *auth_pool, *acct_pool;
1391         const char *auth_pool_name, *acct_pool_name;
1392 #endif
1393
1394         name2 = cf_section_name1(cs);
1395         if (!name2 || (strcasecmp(name2, "realm") != 0)) {
1396                 cf_log_err(cf_sectiontoitem(cs), "Section is not a realm.");
1397                 return 0;
1398         }
1399
1400         name2 = cf_section_name2(cs);
1401         if (!name2) {
1402                 cf_log_err(cf_sectiontoitem(cs), "Realm section is missing the realm name.");
1403                 return 0;
1404         }
1405
1406 #ifdef WITH_PROXY
1407         auth_pool = acct_pool = NULL;
1408         auth_pool_name = acct_pool_name = NULL;
1409
1410         /*
1411          *      Prefer new configuration to old one.
1412          */
1413         cp = cf_pair_find(cs, "pool");
1414         if (!cp) cp = cf_pair_find(cs, "home_server_pool");
1415         if (cp) auth_pool_name = cf_pair_value(cp);
1416         if (cp && auth_pool_name) {
1417                 acct_pool_name = auth_pool_name;
1418                 if (!add_pool_to_realm(rc, cs,
1419                                        auth_pool_name, &auth_pool,
1420                                        HOME_TYPE_AUTH, 1)) {
1421                         return 0;
1422                 }
1423                 if (!add_pool_to_realm(rc, cs,
1424                                        auth_pool_name, &acct_pool,
1425                                        HOME_TYPE_ACCT, 0)) {
1426                         return 0;
1427                 }
1428         }
1429
1430         cp = cf_pair_find(cs, "auth_pool");
1431         if (cp) auth_pool_name = cf_pair_value(cp);
1432         if (cp && auth_pool_name) {
1433                 if (auth_pool) {
1434                         cf_log_err(cf_sectiontoitem(cs), "Cannot use \"pool\" and \"auth_pool\" at the same time.");
1435                         return 0;
1436                 }
1437                 if (!add_pool_to_realm(rc, cs,
1438                                        auth_pool_name, &auth_pool,
1439                                        HOME_TYPE_AUTH, 1)) {
1440                         return 0;
1441                 }
1442         }
1443
1444         cp = cf_pair_find(cs, "acct_pool");
1445         if (cp) acct_pool_name = cf_pair_value(cp);
1446         if (cp && acct_pool_name) {
1447                 int do_print = TRUE;
1448
1449                 if (acct_pool) {
1450                         cf_log_err(cf_sectiontoitem(cs), "Cannot use \"pool\" and \"acct_pool\" at the same time.");
1451                         return 0;
1452                 }
1453
1454                 if (!auth_pool ||
1455                     (strcmp(auth_pool_name, acct_pool_name) != 0)) {
1456                         do_print = TRUE;
1457                 }
1458
1459                 if (!add_pool_to_realm(rc, cs,
1460                                        acct_pool_name, &acct_pool,
1461                                        HOME_TYPE_ACCT, do_print)) {
1462                         return 0;
1463                 }
1464         }
1465 #endif
1466
1467         cf_log_info(cs, " realm %s {", name2);
1468
1469 #ifdef WITH_PROXY
1470         /*
1471          *      The realm MAY already exist if it's an old-style realm.
1472          *      In that case, merge the old-style realm with this one.
1473          */
1474         r = realm_find2(name2);
1475         if (r && (strcmp(r->name, name2) == 0)) {
1476                 if (cf_pair_find(cs, "auth_pool") ||
1477                     cf_pair_find(cs, "acct_pool")) {
1478                         cf_log_err(cf_sectiontoitem(cs), "Duplicate realm \"%s\"", name2);
1479                         goto error;
1480                 }
1481
1482                 if (!old_realm_config(rc, cs, r)) {
1483                         goto error;
1484                 }
1485
1486                 cf_log_info(cs, " } # realm %s", name2);
1487                 return 1;
1488         }
1489 #endif
1490
1491 #ifdef HAVE_REGEX_H
1492         if (name2[0] == '~') {
1493                 int rcode;
1494                 regex_t reg;
1495
1496                 /*
1497                  *      Include substring matches.
1498                  */
1499                 rcode = regcomp(&reg, name2 + 1,
1500                                 REG_EXTENDED | REG_NOSUB | REG_ICASE);
1501                 if (rcode != 0) {
1502                         char buffer[256];
1503
1504                         regerror(rcode, &reg, buffer, sizeof(buffer));
1505
1506                         cf_log_err(cf_sectiontoitem(cs),
1507                                    "Invalid regex \"%s\": %s",
1508                                    name2 + 1, buffer);
1509                         goto error;
1510                 }
1511                 regfree(&reg);
1512         }
1513 #endif
1514
1515         r = rad_malloc(sizeof(*r));
1516         memset(r, 0, sizeof(*r));
1517
1518         r->name = name2;
1519         r->striprealm = 1;
1520 #ifdef WITH_PROXY
1521         r->auth_pool = auth_pool;
1522         r->acct_pool = acct_pool;
1523
1524         if (auth_pool_name &&
1525             (auth_pool_name == acct_pool_name)) { /* yes, ptr comparison */
1526                 cf_log_info(cs, "\tpool = %s", auth_pool_name);
1527         } else {
1528                 if (auth_pool_name) cf_log_info(cs, "\tauth_pool = %s", auth_pool_name);
1529                 if (acct_pool_name) cf_log_info(cs, "\tacct_pool = %s", acct_pool_name);
1530         }
1531 #endif
1532
1533         cp = cf_pair_find(cs, "nostrip");
1534         if (cp && (cf_pair_value(cp) == NULL)) {
1535                 r->striprealm = 0;
1536                 cf_log_info(cs, "\tnostrip");
1537         }
1538
1539         /*
1540          *      We're a new-style realm.  Complain if we see the old
1541          *      directives.
1542          */
1543         if (r->auth_pool || r->acct_pool) {
1544                 if (((cp = cf_pair_find(cs, "authhost")) != NULL) ||
1545                     ((cp = cf_pair_find(cs, "accthost")) != NULL) ||
1546                     ((cp = cf_pair_find(cs, "secret")) != NULL) ||
1547                     ((cp = cf_pair_find(cs, "ldflag")) != NULL)) {
1548                         DEBUG2("WARNING: Ignoring old-style configuration entry \"%s\" in realm \"%s\"", cf_pair_attr(cp), r->name);
1549                 }
1550
1551
1552                 /*
1553                  *      The realm MAY be an old-style realm, as there
1554                  *      was no auth_pool or acct_pool.  Double-check
1555                  *      it, just to be safe.
1556                  */
1557         } else if (!old_realm_config(rc, cs, r)) {
1558                 goto error;
1559         }
1560
1561 #ifdef HAVE_REGEX_H
1562         /*
1563          *      It's a regex.  Add it to a separate list.
1564          */
1565         if (name2[0] == '~') {
1566                 realm_regex_t *rr, **last;
1567
1568                 rr = rad_malloc(sizeof(*rr));
1569
1570                 last = &realms_regex;
1571                 while (*last) last = &((*last)->next);  /* O(N^2)... sue me. */
1572
1573                 r->name = name2;
1574                 rr->realm = r;
1575                 rr->next = NULL;
1576
1577                 *last = rr;
1578
1579                 cf_log_info(cs, " }");
1580                 return 1;
1581         }
1582 #endif
1583
1584         if (!rbtree_insert(realms_byname, r)) {
1585                 rad_assert("Internal sanity check failed");
1586                 goto error;
1587         }
1588
1589         cf_log_info(cs, " }");
1590
1591         return 1;
1592
1593  error:
1594         cf_log_info(cs, " } # realm %s", name2);
1595         free(r);
1596         return 0;
1597 }
1598
1599 #ifdef WITH_COA
1600 static const FR_NAME_NUMBER home_server_types[] = {
1601         { "auth", HOME_TYPE_AUTH },
1602         { "auth+acct", HOME_TYPE_AUTH },
1603         { "acct", HOME_TYPE_ACCT },
1604         { "coa", HOME_TYPE_COA },
1605         { NULL, 0 }
1606 };
1607
1608 static int pool_peek_type(CONF_SECTION *config, CONF_SECTION *cs)
1609 {
1610         int home;
1611         const char *name, *type;
1612         CONF_PAIR *cp;
1613         CONF_SECTION *server_cs;
1614
1615         cp = cf_pair_find(cs, "home_server");
1616         if (!cp) {
1617                 cf_log_err(cf_sectiontoitem(cs), "Pool does not contain a \"home_server\" entry");
1618                 return HOME_TYPE_INVALID;
1619         }
1620
1621         name = cf_pair_value(cp);
1622         if (!name) {
1623                 cf_log_err(cf_pairtoitem(cp), "home_server entry does not reference a home server");
1624                 return HOME_TYPE_INVALID;
1625         }
1626
1627         server_cs = cf_section_sub_find_name2(config, "home_server", name);
1628         if (!server_cs) {
1629                 cf_log_err(cf_pairtoitem(cp), "home_server \"%s\" does not exist", name);
1630                 return HOME_TYPE_INVALID;
1631         }
1632
1633         cp = cf_pair_find(server_cs, "type");
1634         if (!cp) {
1635                 cf_log_err(cf_sectiontoitem(server_cs), "home_server %s does not contain a \"type\" entry", name);
1636                 return HOME_TYPE_INVALID;
1637         }
1638
1639         type = cf_pair_value(cp);
1640         if (!type) {
1641                 cf_log_err(cf_sectiontoitem(server_cs), "home_server %s contains an empty \"type\" entry", name);
1642                 return HOME_TYPE_INVALID;
1643         }
1644
1645         home = fr_str2int(home_server_types, type, HOME_TYPE_INVALID);
1646         if (home == HOME_TYPE_INVALID) {
1647                 cf_log_err(cf_sectiontoitem(server_cs), "home_server %s contains an invalid \"type\" entry of value \"%s\"", name, type);
1648                 return HOME_TYPE_INVALID;
1649         }
1650
1651         return home;            /* 'cause we miss it so much */
1652 }
1653 #endif
1654
1655 int realms_init(CONF_SECTION *config)
1656 {
1657         CONF_SECTION *cs;
1658         realm_config_t *rc, *old_rc;
1659
1660         if (realms_byname) return 1;
1661
1662         realms_byname = rbtree_create(realm_name_cmp, free, 0);
1663         if (!realms_byname) {
1664                 realms_free();
1665                 return 0;
1666         }
1667
1668 #ifdef WITH_PROXY
1669         home_servers_byaddr = rbtree_create(home_server_addr_cmp, free, 0);
1670         if (!home_servers_byaddr) {
1671                 realms_free();
1672                 return 0;
1673         }
1674
1675         home_servers_byname = rbtree_create(home_server_name_cmp, NULL, 0);
1676         if (!home_servers_byname) {
1677                 realms_free();
1678                 return 0;
1679         }
1680
1681 #ifdef WITH_STATS
1682         home_servers_bynumber = rbtree_create(home_server_number_cmp, NULL, 0);
1683         if (!home_servers_bynumber) {
1684                 realms_free();
1685                 return 0;
1686         }
1687 #endif
1688
1689         home_pools_byname = rbtree_create(home_pool_name_cmp, NULL, 0);
1690         if (!home_pools_byname) {
1691                 realms_free();
1692                 return 0;
1693         }
1694 #endif
1695
1696         rc = rad_malloc(sizeof(*rc));
1697         memset(rc, 0, sizeof(*rc));
1698         rc->cs = config;
1699
1700 #ifdef WITH_PROXY
1701         cs = cf_subsection_find_next(config, NULL, "proxy");
1702         if (cs) {
1703                 cf_section_parse(cs, rc, proxy_config);
1704         } else {
1705                 rc->dead_time = DEAD_TIME;
1706                 rc->retry_count = RETRY_COUNT;
1707                 rc->retry_delay = RETRY_DELAY;
1708                 rc->fallback = 0;
1709                 rc->wake_all_if_all_dead= 0;
1710         }
1711 #endif
1712
1713         for (cs = cf_subsection_find_next(config, NULL, "home_server");
1714              cs != NULL;
1715              cs = cf_subsection_find_next(config, cs, "home_server")) {
1716                 if (!home_server_add(rc, cs)) {
1717                         free(rc);
1718                         realms_free();
1719                         return 0;
1720                 }
1721         }
1722
1723         for (cs = cf_subsection_find_next(config, NULL, "realm");
1724              cs != NULL;
1725              cs = cf_subsection_find_next(config, cs, "realm")) {
1726                 if (!realm_add(rc, cs)) {
1727                         free(rc);
1728                         realms_free();
1729                         return 0;
1730                 }
1731         }
1732
1733 #ifdef WITH_COA
1734         /*
1735          *      CoA pools aren't tied to realms.
1736          */
1737         for (cs = cf_subsection_find_next(config, NULL, "home_server_pool");
1738              cs != NULL;
1739              cs = cf_subsection_find_next(config, cs, "home_server_pool")) {
1740                 int type;
1741
1742                 /*
1743                  *      Pool was already loaded.
1744                  */
1745                 if (cf_data_find(cs, "home_server_pool")) continue;
1746
1747                 type = pool_peek_type(config, cs);
1748                 if (type == HOME_TYPE_INVALID) return 0;
1749
1750                 if (!server_pool_add(rc, cs, type, TRUE)) {
1751                         return 0;
1752                 }
1753         }
1754 #endif
1755
1756
1757 #ifdef WITH_PROXY
1758         xlat_register("home_server", xlat_home_server, NULL);
1759         xlat_register("home_server_pool", xlat_server_pool, NULL);
1760 #endif
1761
1762         /*
1763          *      Swap pointers atomically.
1764          */
1765         old_rc = realm_config;
1766         realm_config = rc;
1767         free(old_rc);
1768
1769         return 1;
1770 }
1771
1772 /*
1773  *      Find a realm where "name" might be the regex.
1774  */
1775 REALM *realm_find2(const char *name)
1776 {
1777         REALM myrealm;
1778         REALM *realm;
1779
1780         if (!name) name = "NULL";
1781
1782         myrealm.name = name;
1783         realm = rbtree_finddata(realms_byname, &myrealm);
1784         if (realm) return realm;
1785
1786 #ifdef HAVE_REGEX_H
1787         if (realms_regex) {
1788                 realm_regex_t *this;
1789
1790                 for (this = realms_regex; this != NULL; this = this->next) {
1791                         if (strcmp(this->realm->name, name) == 0) {
1792                                 return this->realm;
1793                         }
1794                 }
1795         }
1796 #endif
1797
1798         /*
1799          *      Couldn't find a realm.  Look for DEFAULT.
1800          */
1801         myrealm.name = "DEFAULT";
1802         return rbtree_finddata(realms_byname, &myrealm);
1803 }
1804
1805
1806 /*
1807  *      Find a realm in the REALM list.
1808  */
1809 REALM *realm_find(const char *name)
1810 {
1811         REALM myrealm;
1812         REALM *realm;
1813
1814         if (!name) name = "NULL";
1815
1816         myrealm.name = name;
1817         realm = rbtree_finddata(realms_byname, &myrealm);
1818         if (realm) return realm;
1819
1820 #ifdef HAVE_REGEX_H
1821         if (realms_regex) {
1822                 realm_regex_t *this;
1823
1824                 for (this = realms_regex; this != NULL; this = this->next) {
1825                         int compare;
1826                         regex_t reg;
1827
1828                         /*
1829                          *      Include substring matches.
1830                          */
1831                         if (regcomp(&reg, this->realm->name + 1,
1832                                     REG_EXTENDED | REG_NOSUB | REG_ICASE) != 0) {
1833                                 continue;
1834                         }
1835
1836                         compare = regexec(&reg, name, 0, NULL, 0);
1837                         regfree(&reg);
1838
1839                         if (compare == 0) return this->realm;
1840                 }
1841         }
1842 #endif
1843
1844         /*
1845          *      Couldn't find a realm.  Look for DEFAULT.
1846          */
1847         myrealm.name = "DEFAULT";
1848         return rbtree_finddata(realms_byname, &myrealm);
1849 }
1850
1851
1852 #ifdef WITH_PROXY
1853 home_server *home_server_ldb(const char *realmname,
1854                              home_pool_t *pool, REQUEST *request)
1855 {
1856         int             start;
1857         int             count;
1858         home_server     *found = NULL;
1859         home_server     *zombie = NULL;
1860         VALUE_PAIR      *vp;
1861
1862         /*
1863          *      Determine how to pick choose the home server.
1864          */
1865         switch (pool->type) {
1866                 uint32_t hash;
1867
1868                 /*
1869                  *      For load-balancing by client IP address, we
1870                  *      pick a home server by hashing the client IP.
1871                  *
1872                  *      This isn't as even a load distribution as
1873                  *      tracking the State attribute, but it's better
1874                  *      than nothing.
1875                  */
1876         case HOME_POOL_CLIENT_BALANCE:
1877                 switch (request->packet->src_ipaddr.af) {
1878                 case AF_INET:
1879                         hash = fr_hash(&request->packet->src_ipaddr.ipaddr.ip4addr,
1880                                          sizeof(request->packet->src_ipaddr.ipaddr.ip4addr));
1881                         break;
1882                 case AF_INET6:
1883                         hash = fr_hash(&request->packet->src_ipaddr.ipaddr.ip6addr,
1884                                          sizeof(request->packet->src_ipaddr.ipaddr.ip6addr));
1885                         break;
1886                 default:
1887                         hash = 0;
1888                         break;
1889                 }
1890                 start = hash % pool->num_home_servers;
1891                 break;
1892
1893         case HOME_POOL_CLIENT_PORT_BALANCE:
1894                 switch (request->packet->src_ipaddr.af) {
1895                 case AF_INET:
1896                         hash = fr_hash(&request->packet->src_ipaddr.ipaddr.ip4addr,
1897                                          sizeof(request->packet->src_ipaddr.ipaddr.ip4addr));
1898                         break;
1899                 case AF_INET6:
1900                         hash = fr_hash(&request->packet->src_ipaddr.ipaddr.ip6addr,
1901                                          sizeof(request->packet->src_ipaddr.ipaddr.ip6addr));
1902                         break;
1903                 default:
1904                         hash = 0;
1905                         break;
1906                 }
1907                 fr_hash_update(&request->packet->src_port,
1908                                  sizeof(request->packet->src_port), hash);
1909                 start = hash % pool->num_home_servers;
1910                 break;
1911
1912         case HOME_POOL_KEYED_BALANCE:
1913                 if ((vp = pairfind(request->config_items, PW_LOAD_BALANCE_KEY)) != NULL) {
1914                         hash = fr_hash(vp->vp_strvalue, vp->length);
1915                         start = hash % pool->num_home_servers;
1916                         break;
1917                 }
1918                 /* FALL-THROUGH */
1919
1920         case HOME_POOL_LOAD_BALANCE:
1921         case HOME_POOL_FAIL_OVER:
1922                 start = 0;
1923                 break;
1924
1925         default:                /* this shouldn't happen... */
1926                 start = 0;
1927                 break;
1928
1929         }
1930
1931         /*
1932          *      Starting with the home server we chose, loop through
1933          *      all home servers.  If the current one is dead, skip
1934          *      it.  If it is too busy, skip it.
1935          *
1936          *      Otherwise, use it.
1937          */
1938         for (count = 0; count < pool->num_home_servers; count++) {
1939                 home_server *home = pool->servers[(start + count) % pool->num_home_servers];
1940
1941                 if (!home) continue;
1942
1943                 /*
1944                  *      Skip dead home servers.
1945                  */
1946                 if (home->state == HOME_STATE_IS_DEAD) {
1947                         continue;
1948                 }
1949
1950                 /*
1951                  *      This home server is too busy.  Choose another one.
1952                  */
1953                 if (home->currently_outstanding >= home->max_outstanding) {
1954                         continue;
1955                 }
1956
1957 #ifdef WITH_DETAIL
1958                 /*
1959                  *      We read the packet from a detail file, AND it
1960                  *      came from this server.  Don't re-proxy it
1961                  *      there.
1962                  */
1963                 if ((request->listener->type == RAD_LISTEN_DETAIL) &&
1964                     (request->packet->code == PW_ACCOUNTING_REQUEST) &&
1965                     (fr_ipaddr_cmp(&home->ipaddr, &request->packet->src_ipaddr) == 0)) {
1966                         continue;
1967                 }
1968 #endif
1969
1970                 /*
1971                  *      It's zombie, so we remember the first zombie
1972                  *      we find, but we don't mark it as a "live"
1973                  *      server.
1974                  */
1975                 if (home->state == HOME_STATE_ZOMBIE) {
1976                         if (!zombie) zombie = home;
1977                         continue;
1978                 }
1979
1980                 /*
1981                  *      We've found the first "live" one.  Use that.
1982                  */
1983                 if (pool->type != HOME_POOL_LOAD_BALANCE) {
1984                         found = home;
1985                         break;
1986                 }
1987
1988                 /*
1989                  *      Otherwise we're doing some kind of load balancing.
1990                  *      If we haven't found one yet, pick this one.
1991                  */
1992                 if (!found) {
1993                         found = home;
1994                         continue;
1995                 }
1996
1997                 RDEBUG3("PROXY %s %d\t%s %d",
1998                        found->name, found->currently_outstanding,
1999                        home->name, home->currently_outstanding);
2000
2001                 /*
2002                  *      Prefer this server if it's less busy than the
2003                  *      one we had previously found.
2004                  */
2005                 if (home->currently_outstanding < found->currently_outstanding) {
2006                         RDEBUG3("PROXY Choosing %s: It's less busy than %s",
2007                                home->name, found->name);
2008                         found = home;
2009                         continue;
2010                 }
2011
2012                 /*
2013                  *      Ignore servers which are busier than the one
2014                  *      we found.
2015                  */
2016                 if (home->currently_outstanding > found->currently_outstanding) {
2017                         RDEBUG3("PROXY Skipping %s: It's busier than %s",
2018                                home->name, found->name);
2019                         continue;
2020                 }
2021
2022                 /*
2023                  *      From the list of servers which have the same
2024                  *      load, choose one at random.
2025                  */
2026                 if (((count + 1) * (fr_rand() & 0xffff)) < (uint32_t) 0x10000) {
2027                         found = home;
2028                 }
2029         } /* loop over the home servers */
2030
2031         /*
2032          *      We have no live servers, BUT we have a zombie.  Use
2033          *      the zombie as a last resort.
2034          */
2035         if (!found && zombie) {
2036                 found = zombie;
2037                 zombie = NULL;
2038         }
2039
2040         /*
2041          *      There's a fallback if they're all dead.
2042          */
2043         if (!found && pool->fallback) {
2044                 found = pool->fallback;
2045         }
2046
2047         if (found) {
2048         update_and_return:
2049                 /*
2050                  *      Allocate the proxy packet, only if it wasn't
2051                  *      already allocated by a module.  This check is
2052                  *      mainly to support the proxying of EAP-TTLS and
2053                  *      EAP-PEAP tunneled requests.
2054                  *
2055                  *      In those cases, the EAP module creates a
2056                  *      "fake" request, and recursively passes it
2057                  *      through the authentication stage of the
2058                  *      server.  The module then checks if the request
2059                  *      was supposed to be proxied, and if so, creates
2060                  *      a proxy packet from the TUNNELED request, and
2061                  *      not from the EAP request outside of the
2062                  *      tunnel.
2063                  *
2064                  *      The proxy then works like normal, except that
2065                  *      the response packet is "eaten" by the EAP
2066                  *      module, and encapsulated into an EAP packet.
2067                  */
2068                 if (!request->proxy) {
2069                         if ((request->proxy = rad_alloc(TRUE)) == NULL) {
2070                                 radlog(L_ERR|L_CONS, "no memory");
2071                                 exit(1);
2072                         }
2073
2074                         /*
2075                          *      Copy the request, then look up name
2076                          *      and plain-text password in the copy.
2077                          *
2078                          *      Note that the User-Name attribute is
2079                          *      the *original* as sent over by the
2080                          *      client.  The Stripped-User-Name
2081                          *      attribute is the one hacked through
2082                          *      the 'hints' file.
2083                          */
2084                         request->proxy->vps =  paircopy(request->packet->vps);
2085                 }
2086
2087                 /*
2088                  *      Update the various fields as appropriate.
2089                  */
2090                 request->proxy->src_ipaddr = found->src_ipaddr;
2091                 request->proxy->dst_ipaddr = found->ipaddr;
2092                 request->proxy->dst_port = found->port;
2093                 request->home_server = found;
2094
2095                 /*
2096                  *      We're supposed to add a Message-Authenticator
2097                  *      if it doesn't exist, and it doesn't exist.
2098                  */
2099                 if (found->message_authenticator &&
2100                     (request->packet->code == PW_AUTHENTICATION_REQUEST) &&
2101                     !pairfind(request->proxy->vps, PW_MESSAGE_AUTHENTICATOR)) {
2102                         radius_pairmake(request, &request->proxy->vps,
2103                                         "Message-Authenticator", "0x00",
2104                                         T_OP_SET);
2105                 }
2106
2107                 return found;
2108         }
2109
2110         /*
2111          *      No live match found, and no fallback to the "DEFAULT"
2112          *      realm.  We fix this by blindly marking all servers as
2113          *      "live".  But only do it for ones that don't support
2114          *      "pings", as they will be marked live when they
2115          *      actually are live.
2116          */
2117         if (!realm_config->fallback &&
2118             realm_config->wake_all_if_all_dead) {
2119                 for (count = 0; count < pool->num_home_servers; count++) {
2120                         home_server *home = pool->servers[count];
2121
2122                         if (!home) continue;
2123
2124                         if ((home->state == HOME_STATE_IS_DEAD) &&
2125                             (home->ping_check == HOME_PING_CHECK_NONE)) {
2126                                 home->state = HOME_STATE_ALIVE;
2127                                 if (!found) found = home;
2128                         }
2129                 }
2130
2131                 if (found) goto update_and_return;
2132         }
2133
2134         /*
2135          *      Still nothing.  Look up the DEFAULT realm, but only
2136          *      if we weren't looking up the NULL or DEFAULT realms.
2137          */
2138         if (realm_config->fallback &&
2139             realmname &&
2140             (strcmp(realmname, "NULL") != 0) &&
2141             (strcmp(realmname, "DEFAULT") != 0)) {
2142                 REALM *rd = realm_find("DEFAULT");
2143
2144                 if (!rd) return NULL;
2145
2146                 pool = NULL;
2147                 if (request->packet->code == PW_AUTHENTICATION_REQUEST) {
2148                         pool = rd->auth_pool;
2149
2150                 } else if (request->packet->code == PW_ACCOUNTING_REQUEST) {
2151                         pool = rd->acct_pool;
2152                 }
2153                 if (!pool) return NULL;
2154
2155                 RDEBUG2("PROXY - realm %s has no live home servers.  Falling back to the DEFAULT realm.", realmname);
2156                 return home_server_ldb(rd->name, pool, request);
2157         }
2158
2159         /*
2160          *      Still haven't found anything.  Oh well.
2161          */
2162         return NULL;
2163 }
2164
2165
2166 home_server *home_server_find(fr_ipaddr_t *ipaddr, int port)
2167 {
2168         home_server myhome;
2169
2170         memset(&myhome, 0, sizeof(myhome));
2171         myhome.ipaddr = *ipaddr;
2172         myhome.port = port;
2173         myhome.server = NULL;   /* we're not called for internal proxying */
2174
2175         return rbtree_finddata(home_servers_byaddr, &myhome);
2176 }
2177
2178 #ifdef WITH_COA
2179 home_server *home_server_byname(const char *name, int type)
2180 {
2181         home_server myhome;
2182
2183         memset(&myhome, 0, sizeof(myhome));
2184         myhome.type = type;
2185         myhome.name = name;
2186
2187         return rbtree_finddata(home_servers_byname, &myhome);
2188 }
2189 #endif
2190
2191 #ifdef WITH_STATS
2192 home_server *home_server_bynumber(int number)
2193 {
2194         home_server myhome;
2195
2196         memset(&myhome, 0, sizeof(myhome));
2197         myhome.number = number;
2198         myhome.server = NULL;   /* we're not called for internal proxying */
2199
2200         return rbtree_finddata(home_servers_bynumber, &myhome);
2201 }
2202 #endif
2203
2204 home_pool_t *home_pool_byname(const char *name, int type)
2205 {
2206         home_pool_t mypool;
2207
2208         memset(&mypool, 0, sizeof(mypool));
2209         mypool.name = name;
2210         mypool.server_type = type;
2211         return rbtree_finddata(home_pools_byname, &mypool);
2212 }
2213
2214 #endif
2215
2216 #ifdef WITH_PROXY
2217 static int home_server_create_callback(UNUSED void *ctx, void *data)
2218 {
2219         home_server *home = data;
2220         rad_listen_t *this;
2221
2222         /*
2223          *      If there WAS a src address defined, ensure that a
2224          *      proxy listener has been defined.
2225          */
2226         if (home->src_ipaddr.af != AF_UNSPEC) {
2227                 this = proxy_new_listener(&home->src_ipaddr, TRUE);
2228
2229                 /*
2230                  *      Failed to create it: Die
2231                  */
2232                 if (!this) return 1;
2233
2234                 /*
2235                  *      Don't do anything else.  The function above
2236                  *      takes care of adding the listener to the list.
2237                  */
2238         }
2239
2240         return 0;
2241 }
2242
2243 /*
2244  *      Taking a void* here solves some header issues.
2245  */
2246 int home_server_create_listeners(void)
2247 {
2248         if (!home_servers_byaddr) return 0;
2249
2250         /*
2251          *      Add the listeners to the TAIL of the list.
2252          */
2253         if (rbtree_walk(home_servers_byaddr, InOrder,
2254                         home_server_create_callback, NULL) != 0) {
2255                 return -1;
2256         }
2257
2258         return 0;
2259 }
2260 #endif