uint32_t dead_time;
uint32_t retry_count;
uint32_t retry_delay;
+ bool dynamic;
bool fallback;
bool wake_all_if_all_dead;
} realm_config_t;
static realm_config_t *realm_config = NULL;
+static bool realms_initialized = false;
#ifdef WITH_PROXY
static rbtree_t *home_servers_byaddr = NULL;
{ "default_fallback", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, realm_config_t, fallback), "no" },
+ { "dynamic", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, realm_config_t, dynamic), NULL },
+
{ "dead_time", FR_CONF_OFFSET(PW_TYPE_INTEGER, realm_config_t, dead_time), STRINGIFY(DEAD_TIME) },
{ "wake_all_if_all_dead", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, realm_config_t, wake_all_if_all_dead), "no" },
{ NULL, -1, 0, NULL, NULL } /* end the list */
};
-static fr_ipaddr_t hs_ip4addr;
-static fr_ipaddr_t hs_ip6addr;
+static fr_ipaddr_t hs_ipaddr;
static char const *hs_srcipaddr = NULL;
static char const *hs_type = NULL;
static char const *hs_check = NULL;
#endif
static CONF_PARSER home_server_config[] = {
- { "ipaddr", FR_CONF_POINTER(PW_TYPE_IPADDR, &hs_ip4addr), NULL },
- { "ipv6addr", FR_CONF_POINTER(PW_TYPE_IPV6ADDR, &hs_ip6addr), NULL },
+ { "ipaddr", FR_CONF_POINTER(PW_TYPE_IP_ADDR, &hs_ipaddr), NULL },
+ { "ipv4addr", FR_CONF_POINTER(PW_TYPE_IPV4_ADDR, &hs_ipaddr), NULL },
+ { "ipv6addr", FR_CONF_POINTER(PW_TYPE_IPV6_ADDR, &hs_ipaddr), NULL },
{ "virtual_server", FR_CONF_POINTER(PW_TYPE_STRING, &hs_virtual_server), NULL },
{ "port", FR_CONF_OFFSET(PW_TYPE_SHORT, home_server_t, port), "0" },
{ "src_ipaddr", FR_CONF_POINTER(PW_TYPE_STRING, &hs_srcipaddr), NULL },
{ "response_window", FR_CONF_OFFSET(PW_TYPE_TIMEVAL, home_server_t, response_window), "30" },
+ { "response_timeouts", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, max_response_timeouts), "1" },
{ "max_outstanding", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, max_outstanding), "65536" },
{ "zombie_period", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, zombie_period), "40" },
{ "ping_interval", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, ping_interval), "30" },
{ "check_interval", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, ping_interval), "30" },
+
+ { "check_timeout", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, ping_timeout), "4" },
+ { "status_check_timeout", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, ping_timeout), NULL },
+
{ "num_answers_to_alive", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, num_pings_to_alive), "3" },
{ "revive_interval", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, revive_interval), "300" },
- { "status_check_timeout", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, ping_timeout), "4" },
{ "username", FR_CONF_OFFSET(PW_TYPE_STRING, home_server_t, ping_user_name), NULL },
{ "password", FR_CONF_OFFSET(PW_TYPE_STRING, home_server_t, ping_user_password), NULL },
* Last packet sent / received are zero.
*/
- memset(&hs_ip4addr, 0, sizeof(hs_ip4addr));
- memset(&hs_ip6addr, 0, sizeof(hs_ip6addr));
+ memset(&hs_ipaddr, 0, sizeof(hs_ipaddr));
if (cf_section_parse(cs, home, home_server_config) < 0) {
goto error;
}
/*
* Figure out which one to use.
*/
- if (cf_pair_find(cs, "ipaddr")) {
- memcpy(&home->ipaddr, &hs_ip4addr, sizeof(home->ipaddr));
- } else if (cf_pair_find(cs, "ipv6addr")) {
- memcpy(&home->ipaddr, &hs_ip6addr, sizeof(home->ipaddr));
+ if (cf_pair_find(cs, "ipaddr") || cf_pair_find(cs, "ipv4addr") || cf_pair_find(cs, "ipv6addr")) {
+ if (is_wildcard(&hs_ipaddr)) {
+ cf_log_err_cs(cs, "Wildcard '*' addresses are not permitted for home servers");
+ goto error;
+ }
+ home->ipaddr = hs_ipaddr;
} else if ((cp = cf_pair_find(cs, "virtual_server")) != NULL) {
home->ipaddr.af = AF_UNSPEC;
home->server = cf_pair_value(cp);
goto skip_port;
} else {
- cf_log_err_cs(cs, "No ipaddr, ipv6addr, or virtual_server defined for home server \"%s\"", name2);
+ cf_log_err_cs(cs, "No ipaddr, ipv4addr, ipv6addr, or virtual_server defined for home server \"%s\"", name2);
error:
hs_type = NULL;
hs_check = NULL;
* address family as the destination IP.
*/
if (hs_srcipaddr) {
- if (ip_hton(home->ipaddr.af, hs_srcipaddr, &home->src_ipaddr) < 0) {
+ if (ip_hton(&home->src_ipaddr, home->ipaddr.af, hs_srcipaddr, false) < 0) {
cf_log_err_cs(cs, "Failed parsing src_ipaddr");
goto error;
}
goto error;
}
+ hs_srcipaddr = NULL;
+
+ return realm_home_server_add(home, cs, dual);
+}
+
+
+int realm_home_server_add(home_server_t *home, CONF_SECTION *cs, int dual)
+{
+ const char *name2 = home->name;
+ CONF_SECTION *parent = NULL;
+
+ /*
+ * The structs aren't mutex protected. Refuse to destroy
+ * the server.
+ */
+ if (realms_initialized && !realm_config->dynamic) {
+ DEBUG("Must set \"dynamic = true\" in proxy.conf");
+ return 0;
+ }
+
/*
* Make sure that this is set.
*/
home->src_ipaddr.af = home->ipaddr.af;
}
- hs_srcipaddr = NULL;
-
if (rbtree_finddata(home_servers_byname, home) != NULL) {
cf_log_err_cs(cs,
"Duplicate home server name %s.", name2);
FR_TIMEVAL_BOUND_CHECK("response_window", &home->response_window, <=,
main_config.max_request_time, 0);
+ FR_INTEGER_BOUND_CHECK("response_timeouts", home->max_response_timeouts, >=, 1);
+ FR_INTEGER_BOUND_CHECK("response_timeouts", home->max_response_timeouts, <=, 1000);
+
/*
* Track the minimum response window, so that we can
* correctly set the timers in process.c
*/
- if (timercmp(&main_config.min_response_window, &home->response_window, >)) {
- main_config.min_response_window = home->response_window;
+ if (timercmp(&main_config.init_delay, &home->response_window, >)) {
+ main_config.init_delay = home->response_window;
}
FR_INTEGER_BOUND_CHECK("zombie_period", home->zombie_period, >=, 1);
FR_INTEGER_BOUND_CHECK("num_pings_to_alive", home->num_pings_to_alive, >=, 3);
FR_INTEGER_BOUND_CHECK("num_pings_to_alive", home->num_pings_to_alive, <=, 10);
- FR_INTEGER_BOUND_CHECK("ping_timeout", home->ping_timeout, >=, 3);
- FR_INTEGER_BOUND_CHECK("ping_timeout", home->ping_timeout, <=, 10);
+ FR_INTEGER_BOUND_CHECK("check_timeout", home->ping_timeout, >=, 1);
+ FR_INTEGER_BOUND_CHECK("check_timeout", home->ping_timeout, <=, 10);
FR_INTEGER_BOUND_CHECK("revive_interval", home->revive_interval, >=, 60);
FR_INTEGER_BOUND_CHECK("revive_interval", home->revive_interval, <=, 3600);
if ((home->limit.lifetime > 0) && (home->limit.idle_timeout > home->limit.lifetime))
home->limit.idle_timeout = 0;
- tls = cf_item_parent(cf_sectiontoitem(cs));
- if (strcmp(cf_section_name1(tls), "server") == 0) {
- home->parent_server = cf_section_name2(tls);
+ parent = cf_item_parent(cf_sectiontoitem(cs));
+ if (strcmp(cf_section_name1(parent), "server") == 0) {
+ home->parent_server = cf_section_name2(parent);
}
if (dual) {
- home_server_t *home2 = talloc(rc, home_server_t);
+ home_server_t *home2 = talloc(home, home_server_t);
memcpy(home2, home, sizeof(*home2));
"Internal error %d adding home server %s.",
__LINE__, name2);
free(home2);
+ error:
return 0;
}
}
+int realm_pool_add(home_pool_t *pool, UNUSED CONF_SECTION *cs)
+{
+ /*
+ * The structs aren't mutex protected. Refuse to destroy
+ * the server.
+ */
+ if (realms_initialized && !realm_config->dynamic) {
+ DEBUG("Must set \"dynamic = true\" in proxy.conf");
+ return 0;
+ }
+
+ if (!rbtree_insert(home_pools_byname, pool)) {
+ rad_assert("Internal sanity check failed" == NULL);
+ return 0;
+ }
+
+ return 1;
+}
+
static int server_pool_add(realm_config_t *rc,
CONF_SECTION *cs, int server_type, int do_print)
{
if (!pool_check_home_server(rc, cp, cf_pair_value(cp),
server_type, &home)) {
+ DEBUG("SHIT %d", __LINE__);
return 0;
}
}
cf_log_info(cs, "\tfallback = %s", pool->fallback->name);
}
- if (!rbtree_insert(home_pools_byname, pool)) {
- rad_assert("Internal sanity check failed");
- goto error;
- }
+ if (!realm_pool_add(pool, cs)) goto error;
if (do_print) cf_log_info(cs, " }");
}
if (!server) {
- if (ip_hton(AF_UNSPEC, p, &home->ipaddr) < 0) {
+ if (ip_hton(&home->ipaddr, AF_UNSPEC, p, false) < 0) {
cf_log_err_cs(cs,
"Failed looking up hostname %s.",
p);
pool->servers[0] = home;
if (!rbtree_insert(home_pools_byname, pool)) {
- rad_assert("Internal sanity check failed");
+ rad_assert("Internal sanity check failed" == NULL);
return 0;
}
}
#endif
-#ifdef HAVE_REGEX_H
- if (name2[0] == '~') {
- int rcode;
- regex_t reg;
-
- /*
- * Include substring matches.
- */
- rcode = regcomp(®, name2 + 1, REG_EXTENDED | REG_NOSUB | REG_ICASE);
- if (rcode != 0) {
- char buffer[256];
-
- regerror(rcode, ®, buffer, sizeof(buffer));
-
- cf_log_err_cs(cs,
- "Invalid regex \"%s\": %s",
- name2 + 1, buffer);
- goto error;
- }
- regfree(®);
- }
-#endif
-
r = rad_malloc(sizeof(*r));
memset(r, 0, sizeof(*r));
goto error;
}
+ if (!realm_realm_add(r, cs)) {
+ goto error;
+ }
+
+ cf_log_info(cs, " }");
+
+ return 1;
+
+ error:
+ cf_log_info(cs, " } # realm %s", name2);
+ free(r);
+ return 0;
+}
+
+
+int realm_realm_add(REALM *r, CONF_SECTION *cs)
+{
+ /*
+ * The structs aren't mutex protected. Refuse to destroy
+ * the server.
+ */
+ if (realms_initialized && !realm_config->dynamic) {
+ DEBUG("Must set \"dynamic = true\" in proxy.conf");
+ return 0;
+ }
+
#ifdef HAVE_REGEX_H
/*
- * It's a regex. Add it to a separate list.
+ * It's a regex. Sanity check it, and add it to a
+ * separate list.
*/
- if (name2[0] == '~') {
+ if (r->name[0] == '~') {
+ int rcode;
realm_regex_t *rr, **last;
+ regex_t reg;
+
+ /*
+ * Include substring matches.
+ */
+ rcode = regcomp(®, r->name + 1, REG_EXTENDED | REG_NOSUB | REG_ICASE);
+ if (rcode != 0) {
+ char buffer[256];
+
+ regerror(rcode, ®, buffer, sizeof(buffer));
+
+ cf_log_err_cs(cs,
+ "Invalid regex \"%s\": %s",
+ r->name + 1, buffer);
+ return 0;
+ }
+ regfree(®);
rr = rad_malloc(sizeof(*rr));
last = &realms_regex;
while (*last) last = &((*last)->next); /* O(N^2)... sue me. */
- r->name = name2;
rr->realm = r;
rr->next = NULL;
*last = rr;
-
- cf_log_info(cs, " }");
return 1;
}
#endif
if (!rbtree_insert(realms_byname, r)) {
- rad_assert("Internal sanity check failed");
- goto error;
+ rad_assert("Internal sanity check failed" == NULL);
+ return 0;
}
- cf_log_info(cs, " }");
-
return 1;
-
- error:
- cf_log_info(cs, " } # realm %s", name2);
- free(r);
- return 0;
}
#ifdef WITH_COA
int realms_init(CONF_SECTION *config)
{
CONF_SECTION *cs;
+ int flags = 0;
#ifdef WITH_PROXY
CONF_SECTION *server_cs;
#endif
- realm_config_t *rc, *old_rc;
-
- if (realms_byname) return 1;
-
- realms_byname = rbtree_create(realm_name_cmp, free, 0);
- if (!realms_byname) {
- realms_free();
- return 0;
- }
-
-#ifdef WITH_PROXY
- home_servers_byaddr = rbtree_create(home_server_addr_cmp, home_server_free, 0);
- if (!home_servers_byaddr) {
- realms_free();
- return 0;
- }
-
- home_servers_byname = rbtree_create(home_server_name_cmp, NULL, 0);
- if (!home_servers_byname) {
- realms_free();
- return 0;
- }
-
-#ifdef WITH_STATS
- home_servers_bynumber = rbtree_create(home_server_number_cmp, NULL, 0);
- if (!home_servers_bynumber) {
- realms_free();
- return 0;
- }
-#endif
+ realm_config_t *rc;
- home_pools_byname = rbtree_create(home_pool_name_cmp, NULL, 0);
- if (!home_pools_byname) {
- realms_free();
- return 0;
- }
-#endif
+ if (realms_initialized) return 1;
rc = talloc_zero(NULL, realm_config_t);
rc->cs = config;
rc->dead_time = DEAD_TIME;
rc->retry_count = RETRY_COUNT;
rc->retry_delay = RETRY_DELAY;
- rc->fallback = 0;
+ rc->fallback = false;
+ rc->dynamic = false;
rc->wake_all_if_all_dead= 0;
}
+ if (rc->dynamic) {
+ flags = RBTREE_FLAG_LOCK;
+ }
+
+ home_servers_byaddr = rbtree_create(NULL, home_server_addr_cmp, home_server_free, flags);
+ if (!home_servers_byaddr) goto error;
+
+ home_servers_byname = rbtree_create(NULL, home_server_name_cmp, NULL, flags);
+ if (!home_servers_byname) goto error;
+
+#ifdef WITH_STATS
+ home_servers_bynumber = rbtree_create(NULL, home_server_number_cmp, NULL, flags);
+ if (!home_servers_bynumber) goto error;
+#endif
+
+ home_pools_byname = rbtree_create(NULL, home_pool_name_cmp, NULL, flags);
+ if (!home_pools_byname) goto error;
+
for (cs = cf_subsection_find_next(config, NULL, "home_server");
cs != NULL;
cs = cf_subsection_find_next(config, cs, "home_server")) {
}
/*
- * Loop over virtual servers to find homes which are
- * defined in them.
+ * Loop over virtual servers to find home servers which
+ * are defined in them.
*/
for (server_cs = cf_subsection_find_next(config, NULL, "server");
server_cs != NULL;
}
#endif
+ /*
+ * Now create the realms, which point to the home servers
+ * and home server pools.
+ */
+ realms_byname = rbtree_create(NULL, realm_name_cmp, NULL, flags);
+ if (!realms_byname) goto error;
+
for (cs = cf_subsection_find_next(config, NULL, "realm");
cs != NULL;
cs = cf_subsection_find_next(config, cs, "realm")) {
if (!realm_add(rc, cs)) {
-#if defined (WITH_PROXY) || defined (WITH_COA)
error:
-#endif
realms_free();
/*
* Must be called after realms_free as home_servers
}
#endif
-
#ifdef WITH_PROXY
xlat_register("home_server", xlat_home_server, NULL, NULL);
xlat_register("home_server_pool", xlat_server_pool, NULL, NULL);
#endif
- /*
- * Swap pointers atomically.
- */
- old_rc = realm_config;
realm_config = rc;
- talloc_free(old_rc);
-
+ realms_initialized = true;
return 1;
}
* Access-Requests have a Message-Authenticator added,
* unless one already exists.
*/
- if ((request->packet->code == PW_CODE_AUTHENTICATION_REQUEST) &&
+ if ((request->packet->code == PW_CODE_ACCESS_REQUEST) &&
!pairfind(request->proxy->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY)) {
pairmake(request->proxy, &request->proxy->vps,
"Message-Authenticator", "0x00",
if ((home->state == HOME_STATE_IS_DEAD) &&
(home->ping_check == HOME_PING_CHECK_NONE)) {
home->state = HOME_STATE_ALIVE;
+ home->response_timeouts = 0;
if (!found) found = home;
}
}
if (!rd) return NULL;
pool = NULL;
- if (request->packet->code == PW_CODE_AUTHENTICATION_REQUEST) {
+ if (request->packet->code == PW_CODE_ACCESS_REQUEST) {
pool = rd->auth_pool;
} else if (request->packet->code == PW_CODE_ACCOUNTING_REQUEST) {
projects / freeradius.git / blobdiff