typedef struct realm_config_t {
CONF_SECTION *cs;
- int dead_time;
- int retry_count;
- int retry_delay;
+ uint32_t dead_time;
+ uint32_t retry_count;
+ uint32_t retry_delay;
+ bool dynamic;
bool fallback;
bool wake_all_if_all_dead;
} realm_config_t;
static realm_config_t *realm_config = NULL;
+static bool realms_initialized = false;
#ifdef WITH_PROXY
static rbtree_t *home_servers_byaddr = NULL;
* Map the proxy server configuration parameters to variables.
*/
static const CONF_PARSER proxy_config[] = {
- { "retry_delay", PW_TYPE_INTEGER,
- offsetof(realm_config_t, retry_delay),
- NULL, STRINGIFY(RETRY_DELAY) },
+ { "retry_delay", FR_CONF_OFFSET(PW_TYPE_INTEGER, realm_config_t, retry_delay), STRINGIFY(RETRY_DELAY) },
- { "retry_count", PW_TYPE_INTEGER,
- offsetof(realm_config_t, retry_count),
- NULL, STRINGIFY(RETRY_COUNT) },
+ { "retry_count", FR_CONF_OFFSET(PW_TYPE_INTEGER, realm_config_t, retry_count), STRINGIFY(RETRY_COUNT) },
- { "default_fallback", PW_TYPE_BOOLEAN,
- offsetof(realm_config_t, fallback),
- NULL, "no" },
+ { "default_fallback", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, realm_config_t, fallback), "no" },
- { "dead_time", PW_TYPE_INTEGER,
- offsetof(realm_config_t, dead_time),
- NULL, STRINGIFY(DEAD_TIME) },
+ { "dynamic", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, realm_config_t, dynamic), NULL },
- { "wake_all_if_all_dead", PW_TYPE_BOOLEAN,
- offsetof(realm_config_t, wake_all_if_all_dead),
- NULL, "no" },
+ { "dead_time", FR_CONF_OFFSET(PW_TYPE_INTEGER, realm_config_t, dead_time), STRINGIFY(DEAD_TIME) },
+
+ { "wake_all_if_all_dead", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, realm_config_t, wake_all_if_all_dead), "no" },
{ NULL, -1, 0, NULL, NULL }
};
}
-static size_t xlat_cs(CONF_SECTION *cs, char const *fmt, char *out, size_t outlen)
-
+static size_t CC_HINT(nonnull) xlat_cs(CONF_SECTION *cs, char const *fmt, char *out, size_t outlen)
{
char const *value = NULL;
/*
* Xlat for %{home_server:foo}
*/
-static ssize_t xlat_home_server(UNUSED void *instance, REQUEST *request,
- char const *fmt, char *out, size_t outlen)
+static ssize_t CC_HINT(nonnull) xlat_home_server(UNUSED void *instance, REQUEST *request,
+ char const *fmt, char *out, size_t outlen)
{
- if (!fmt || !out || (outlen < 1)) return 0;
-
- if (!request || !request->home_server) {
+ if (!request->home_server) {
RWDEBUG("No home_server associated with this request");
*out = '\0';
/*
* Xlat for %{home_server_pool:foo}
*/
-static ssize_t xlat_server_pool(UNUSED void *instance, REQUEST *request,
- char const *fmt, char *out, size_t outlen)
+static ssize_t CC_HINT(nonnull) xlat_server_pool(UNUSED void *instance, REQUEST *request,
+ char const *fmt, char *out, size_t outlen)
{
- if (!fmt || !out || (outlen < 1)) return 0;
-
- if (!request || !request->home_pool) {
+ if (!request->home_pool) {
RWDEBUG("No home_pool associated with this request");
*out = '\0';
#ifdef WITH_PROXY
static CONF_PARSER limit_config[] = {
- { "max_connections", PW_TYPE_INTEGER,
- offsetof(home_server_t, limit.max_connections), NULL, "16" },
-
- { "max_requests", PW_TYPE_INTEGER,
- offsetof(home_server_t, limit.max_requests), NULL, "0" },
-
- { "lifetime", PW_TYPE_INTEGER,
- offsetof(home_server_t, limit.lifetime), NULL, "0" },
-
- { "idle_timeout", PW_TYPE_INTEGER,
- offsetof(home_server_t, limit.idle_timeout), NULL, "0" },
+ { "max_connections", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, limit.max_connections), "16" },
+ { "max_requests", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, limit.max_requests), "0" },
+ { "lifetime", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, limit.lifetime), "0" },
+ { "idle_timeout", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, limit.idle_timeout), "0" },
{ NULL, -1, 0, NULL, NULL } /* end the list */
};
-static struct in_addr hs_ip4addr;
-static struct in6_addr hs_ip6addr;
-static char *hs_srcipaddr = NULL;
-static char *hs_type = NULL;
-static char *hs_check = NULL;
-static char *hs_virtual_server = NULL;
+static fr_ipaddr_t hs_ipaddr;
+static char const *hs_srcipaddr = NULL;
+static char const *hs_type = NULL;
+static char const *hs_check = NULL;
+static char const *hs_virtual_server = NULL;
#ifdef WITH_TCP
-static char *hs_proto = NULL;
+static char const *hs_proto = NULL;
#endif
#ifdef WITH_COA
static CONF_PARSER home_server_coa[] = {
- { "irt", PW_TYPE_INTEGER,
- offsetof(home_server_t, coa_irt), 0, STRINGIFY(2) },
- { "mrt", PW_TYPE_INTEGER,
- offsetof(home_server_t, coa_mrt), 0, STRINGIFY(16) },
- { "mrc", PW_TYPE_INTEGER,
- offsetof(home_server_t, coa_mrc), 0, STRINGIFY(5) },
- { "mrd", PW_TYPE_INTEGER,
- offsetof(home_server_t, coa_mrd), 0, STRINGIFY(30) },
+ { "irt", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, coa_irt), STRINGIFY(2) },
+ { "mrt", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, coa_mrt), STRINGIFY(16) },
+ { "mrc", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, coa_mrc), STRINGIFY(5) },
+ { "mrd", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, coa_mrd), STRINGIFY(30) },
{ NULL, -1, 0, NULL, NULL } /* end the list */
};
#endif
static CONF_PARSER home_server_config[] = {
- { "ipaddr", PW_TYPE_IPADDR,
- 0, &hs_ip4addr, NULL },
- { "ipv6addr", PW_TYPE_IPV6ADDR,
- 0, &hs_ip6addr, NULL },
- { "virtual_server", PW_TYPE_STRING_PTR,
- 0, &hs_virtual_server, NULL },
+ { "ipaddr", FR_CONF_POINTER(PW_TYPE_IP_ADDR, &hs_ipaddr), NULL },
+ { "ipv4addr", FR_CONF_POINTER(PW_TYPE_IPV4_ADDR, &hs_ipaddr), NULL },
+ { "ipv6addr", FR_CONF_POINTER(PW_TYPE_IPV6_ADDR, &hs_ipaddr), NULL },
+ { "virtual_server", FR_CONF_POINTER(PW_TYPE_STRING, &hs_virtual_server), NULL },
- { "port", PW_TYPE_INTEGER,
- offsetof(home_server_t,port), NULL, "0" },
+ { "port", FR_CONF_OFFSET(PW_TYPE_SHORT, home_server_t, port), "0" },
- { "type", PW_TYPE_STRING_PTR,
- 0, &hs_type, NULL },
+ { "type", FR_CONF_POINTER(PW_TYPE_STRING, &hs_type), NULL },
#ifdef WITH_TCP
- { "proto", PW_TYPE_STRING_PTR,
- 0, &hs_proto, NULL },
+ { "proto", FR_CONF_POINTER(PW_TYPE_STRING, &hs_proto), NULL },
#endif
- { "secret", PW_TYPE_STRING_PTR | PW_TYPE_SECRET,
- offsetof(home_server_t,secret), NULL, NULL},
-
- { "src_ipaddr", PW_TYPE_STRING_PTR,
- 0, &hs_srcipaddr, NULL },
-
- { "response_window", PW_TYPE_INTEGER,
- offsetof(home_server_t,response_window), NULL, "30" },
- { "max_outstanding", PW_TYPE_INTEGER,
- offsetof(home_server_t,max_outstanding), NULL, "65536" },
-
- { "zombie_period", PW_TYPE_INTEGER,
- offsetof(home_server_t,zombie_period), NULL, "40" },
- { "status_check", PW_TYPE_STRING_PTR,
- 0, &hs_check, "none" },
- { "ping_check", PW_TYPE_STRING_PTR,
- 0, &hs_check, NULL },
-
- { "ping_interval", PW_TYPE_INTEGER,
- offsetof(home_server_t,ping_interval), NULL, "30" },
- { "check_interval", PW_TYPE_INTEGER,
- offsetof(home_server_t,ping_interval), NULL, "30" },
- { "num_answers_to_alive", PW_TYPE_INTEGER,
- offsetof(home_server_t,num_pings_to_alive), NULL, "3" },
- { "revive_interval", PW_TYPE_INTEGER,
- offsetof(home_server_t,revive_interval), NULL, "300" },
- { "status_check_timeout", PW_TYPE_INTEGER,
- offsetof(home_server_t,ping_timeout), NULL, "4" },
-
- { "username", PW_TYPE_STRING_PTR,
- offsetof(home_server_t,ping_user_name), NULL, NULL},
- { "password", PW_TYPE_STRING_PTR,
- offsetof(home_server_t,ping_user_password), NULL, NULL},
+ { "secret", FR_CONF_OFFSET(PW_TYPE_STRING | PW_TYPE_SECRET, home_server_t, secret), NULL },
+
+ { "src_ipaddr", FR_CONF_POINTER(PW_TYPE_STRING, &hs_srcipaddr), NULL },
+
+ { "response_window", FR_CONF_OFFSET(PW_TYPE_TIMEVAL, home_server_t, response_window), "30" },
+ { "response_timeouts", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, max_response_timeouts), "1" },
+ { "max_outstanding", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, max_outstanding), "65536" },
+
+ { "zombie_period", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, zombie_period), "40" },
+ { "status_check", FR_CONF_POINTER(PW_TYPE_STRING, &hs_check), "none" },
+ { "ping_check", FR_CONF_POINTER(PW_TYPE_STRING, &hs_check), NULL },
+
+ { "ping_interval", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, ping_interval), "30" },
+ { "check_interval", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, ping_interval), "30" },
+
+ { "check_timeout", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, ping_timeout), "4" },
+ { "status_check_timeout", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, ping_timeout), NULL },
+
+ { "num_answers_to_alive", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, num_pings_to_alive), "3" },
+ { "revive_interval", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, revive_interval), "300" },
+
+ { "username", FR_CONF_OFFSET(PW_TYPE_STRING, home_server_t, ping_user_name), NULL },
+ { "password", FR_CONF_OFFSET(PW_TYPE_STRING, home_server_t, ping_user_password), NULL },
#ifdef WITH_STATS
- { "historic_average_window", PW_TYPE_INTEGER,
- offsetof(home_server_t,ema.window), NULL, NULL },
+ { "historic_average_window", FR_CONF_OFFSET(PW_TYPE_INTEGER, home_server_t, ema.window), NULL },
#endif
#ifdef WITH_COA
- { "coa", PW_TYPE_SUBSECTION, 0, NULL, (void const *) home_server_coa },
+ { "coa", FR_CONF_POINTER(PW_TYPE_SUBSECTION, NULL), (void const *) home_server_coa },
#endif
- { "limit", PW_TYPE_SUBSECTION, 0, NULL, (void const *) limit_config },
+ { "limit", FR_CONF_POINTER(PW_TYPE_SUBSECTION, NULL), (void const *) limit_config },
{ NULL, -1, 0, NULL, NULL } /* end the list */
};
name2 = cf_section_name2(cs);
if (!name2) {
- cf_log_err_cs(cs,
- "Home server section is missing a name.");
+ cf_log_err_cs(cs, "Home server section is missing a name");
return 0;
}
* Last packet sent / received are zero.
*/
- memset(&hs_ip4addr, 0, sizeof(hs_ip4addr));
- memset(&hs_ip6addr, 0, sizeof(hs_ip6addr));
+ memset(&hs_ipaddr, 0, sizeof(hs_ipaddr));
if (cf_section_parse(cs, home, home_server_config) < 0) {
goto error;
}
/*
* Figure out which one to use.
*/
- if (cf_pair_find(cs, "ipaddr")) {
- home->ipaddr.af = AF_INET;
- home->ipaddr.ipaddr.ip4addr = hs_ip4addr;
-
- } else if (cf_pair_find(cs, "ipv6addr")) {
- home->ipaddr.af = AF_INET6;
- home->ipaddr.ipaddr.ip6addr = hs_ip6addr;
-
+ if (cf_pair_find(cs, "ipaddr") || cf_pair_find(cs, "ipv4addr") || cf_pair_find(cs, "ipv6addr")) {
+ if (is_wildcard(&hs_ipaddr)) {
+ cf_log_err_cs(cs, "Wildcard '*' addresses are not permitted for home servers");
+ goto error;
+ }
+ home->ipaddr = hs_ipaddr;
} else if ((cp = cf_pair_find(cs, "virtual_server")) != NULL) {
home->ipaddr.af = AF_UNSPEC;
home->server = cf_pair_value(cp);
goto skip_port;
} else {
- cf_log_err_cs(cs,
- "No ipaddr, ipv6addr, or virtual_server defined for home server \"%s\".",
- name2);
+ cf_log_err_cs(cs, "No ipaddr, ipv4addr, ipv6addr, or virtual_server defined for home server \"%s\"", name2);
error:
- TALLOC_FREE(hs_type);
+ hs_type = NULL;
hs_check = NULL;
hs_srcipaddr = NULL;
#ifdef WITH_TCP
return 0;
}
- if (!home->port || (home->port > 65535)) {
- cf_log_err_cs(cs,
- "No port, or invalid port defined for home server %s.",
- name2);
- goto error;
- }
-
- if (0) {
- cf_log_err_cs(cs,
- "Fatal error! Home server %s is ourselves!",
- name2);
+ if (home->port == 0) {
+ cf_log_err_cs(cs, "No port, or invalid port defined for home server %s", name2);
goto error;
}
* Use a reasonable default.
*/
skip_port:
- if (!hs_type) hs_type = talloc_strdup(cs, "auth+acct");
-
- if (strcasecmp(hs_type, "auth") == 0) {
+ if (!hs_type || (strcasecmp(hs_type, "auth+acct") == 0)) {
+ home->type = HOME_TYPE_AUTH;
+ dual = true;
+ } else if (strcasecmp(hs_type, "auth") == 0) {
home->type = HOME_TYPE_AUTH;
} else if (strcasecmp(hs_type, "acct") == 0) {
home->type = HOME_TYPE_ACCT;
-
- } else if (strcasecmp(hs_type, "auth+acct") == 0) {
- home->type = HOME_TYPE_AUTH;
- dual = true;
-
#ifdef WITH_COA
} else if (strcasecmp(hs_type, "coa") == 0) {
home->type = HOME_TYPE_COA;
dual = false;
if (home->server != NULL) {
- cf_log_err_cs(cs,
- "Home servers of type \"coa\" cannot point to a virtual server");
+ cf_log_err_cs(cs, "Home servers of type \"coa\" cannot point to a virtual server");
goto error;
}
#endif
} else {
- cf_log_err_cs(cs,
- "Invalid type \"%s\" for home server %s.",
- hs_type, name2);
+ cf_log_err_cs(cs, "Invalid type \"%s\" for home server %s.", hs_type, name2);
goto error;
}
- if (hs_type) talloc_free(hs_type);
hs_type = NULL;
if (!hs_check || (strcasecmp(hs_check, "none") == 0)) {
* address family as the destination IP.
*/
if (hs_srcipaddr) {
- if (ip_hton(hs_srcipaddr, home->ipaddr.af, &home->src_ipaddr) < 0) {
+ if (ip_hton(&home->src_ipaddr, home->ipaddr.af, hs_srcipaddr, false) < 0) {
cf_log_err_cs(cs, "Failed parsing src_ipaddr");
goto error;
}
}
if (tls && (home->proto != IPPROTO_TCP)) {
- cf_log_err_cs(cs, "TLS transport is not available for UDP sockets.");
+ cf_log_err_cs(cs, "TLS transport is not available for UDP sockets");
goto error;
}
#ifndef WITH_TLS
if (tls) {
- cf_log_err_cs(cs, "TLS transport is not available in this executable.");
+ cf_log_err_cs(cs, "TLS transport is not available in this executable");
goto error;
}
#else
goto error;
}
+ hs_srcipaddr = NULL;
+
+ return realm_home_server_add(home, cs, dual);
+}
+
+
+int realm_home_server_add(home_server_t *home, CONF_SECTION *cs, int dual)
+{
+ const char *name2 = home->name;
+ CONF_SECTION *parent = NULL;
+
+ /*
+ * The structs aren't mutex protected. Refuse to destroy
+ * the server.
+ */
+ if (realms_initialized && !realm_config->dynamic) {
+ DEBUG("Must set \"dynamic = true\" in proxy.conf");
+ return 0;
+ }
+
/*
* Make sure that this is set.
*/
home->src_ipaddr.af = home->ipaddr.af;
}
- hs_srcipaddr = NULL;
-
if (rbtree_finddata(home_servers_byname, home) != NULL) {
cf_log_err_cs(cs,
"Duplicate home server name %s.", name2);
}
#endif
- if (home->max_outstanding < 8) home->max_outstanding = 8;
- if (home->max_outstanding > 65536*16) home->max_outstanding = 65536*16;
+ FR_INTEGER_BOUND_CHECK("max_outstanding", home->max_outstanding, >=, 8);
+ FR_INTEGER_BOUND_CHECK("max_outstanding", home->max_outstanding, <=, 65536*16);
- if (home->ping_interval < 6) home->ping_interval = 6;
- if (home->ping_interval > 120) home->ping_interval = 120;
+ FR_INTEGER_BOUND_CHECK("ping_interval", home->ping_interval, >=, 6);
+ FR_INTEGER_BOUND_CHECK("ping_interval", home->ping_interval, <=, 120);
- if (home->response_window < 1) home->response_window = 1;
- if (home->response_window > 60) home->response_window = 60;
- if (home->response_window > mainconfig.max_request_time) home->response_window = mainconfig.max_request_time;
+ FR_TIMEVAL_BOUND_CHECK("response_window", &home->response_window, >=, 0, 1000);
+ FR_TIMEVAL_BOUND_CHECK("response_window", &home->response_window, <=, 60, 0);
+ FR_TIMEVAL_BOUND_CHECK("response_window", &home->response_window, <=,
+ main_config.max_request_time, 0);
- if (home->zombie_period < 1) home->zombie_period = 1;
- if (home->zombie_period > 120) home->zombie_period = 120;
+ FR_INTEGER_BOUND_CHECK("response_timeouts", home->response_timeouts, >=, 1);
+ FR_INTEGER_BOUND_CHECK("response_timeouts", home->response_timeouts, <=, 1000);
- if (home->zombie_period < home->response_window) {
- home->zombie_period = home->response_window;
+ /*
+ * Track the minimum response window, so that we can
+ * correctly set the timers in process.c
+ */
+ if (timercmp(&main_config.init_delay, &home->response_window, >)) {
+ main_config.init_delay = home->response_window;
}
- if (home->num_pings_to_alive < 3) home->num_pings_to_alive = 3;
- if (home->num_pings_to_alive > 10) home->num_pings_to_alive = 10;
+ FR_INTEGER_BOUND_CHECK("zombie_period", home->zombie_period, >=, 1);
+ FR_INTEGER_BOUND_CHECK("zombie_period", home->zombie_period, <=, 120);
+ FR_INTEGER_BOUND_CHECK("zombie_period", home->zombie_period, >=, (uint32_t) home->response_window.tv_sec);
- if (home->ping_timeout < 3) home->ping_timeout = 3;
- if (home->ping_timeout > 10) home->ping_timeout = 10;
+ FR_INTEGER_BOUND_CHECK("num_pings_to_alive", home->num_pings_to_alive, >=, 3);
+ FR_INTEGER_BOUND_CHECK("num_pings_to_alive", home->num_pings_to_alive, <=, 10);
- if (home->revive_interval < 60) home->revive_interval = 60;
- if (home->revive_interval > 3600) home->revive_interval = 3600;
+ FR_INTEGER_BOUND_CHECK("check_timeout", home->ping_timeout, >=, 1);
+ FR_INTEGER_BOUND_CHECK("check_timeout", home->ping_timeout, <=, 10);
+
+ FR_INTEGER_BOUND_CHECK("revive_interval", home->revive_interval, >=, 60);
+ FR_INTEGER_BOUND_CHECK("revive_interval", home->revive_interval, <=, 3600);
#ifdef WITH_COA
- if (home->coa_irt < 1) home->coa_irt = 1;
- if (home->coa_irt > 5) home->coa_irt = 5;
+ FR_INTEGER_BOUND_CHECK("coa_irt", home->coa_irt, >=, 1);
+ FR_INTEGER_BOUND_CHECK("coa_irt", home->coa_irt, <=, 5);
- if (home->coa_mrc < 0) home->coa_mrc = 0;
- if (home->coa_mrc > 20 ) home->coa_mrc = 20;
+ FR_INTEGER_BOUND_CHECK("coa_mrc", home->coa_mrc, <=, 20);
- if (home->coa_mrt < 0) home->coa_mrt = 0;
- if (home->coa_mrt > 30 ) home->coa_mrt = 30;
+ FR_INTEGER_BOUND_CHECK("coa_mrt", home->coa_mrt, <=, 30);
- if (home->coa_mrd < 5) home->coa_mrd = 5;
- if (home->coa_mrd > 60 ) home->coa_mrd = 60;
+ FR_INTEGER_BOUND_CHECK("coa_mrd", home->coa_mrd, >=, 5);
+ FR_INTEGER_BOUND_CHECK("coa_mrd", home->coa_mrd, <=, 60);
#endif
- if (home->limit.max_connections > 1024) home->limit.max_connections = 1024;
+ FR_INTEGER_BOUND_CHECK("max_connections", home->limit.max_connections, <=, 1024);
#ifdef WITH_TCP
/*
if ((home->limit.lifetime > 0) && (home->limit.idle_timeout > home->limit.lifetime))
home->limit.idle_timeout = 0;
- tls = cf_item_parent(cf_sectiontoitem(cs));
- if (strcmp(cf_section_name1(tls), "server") == 0) {
- home->parent_server = cf_section_name2(tls);
+ parent = cf_item_parent(cf_sectiontoitem(cs));
+ if (strcmp(cf_section_name1(parent), "server") == 0) {
+ home->parent_server = cf_section_name2(parent);
}
if (dual) {
- home_server_t *home2 = talloc(rc, home_server_t);
+ home_server_t *home2 = talloc(home, home_server_t);
memcpy(home2, home, sizeof(*home2));
"Internal error %d adding home server %s.",
__LINE__, name2);
free(home2);
+ error:
return 0;
}
if (!name) {
cf_log_err_cp(cp,
- "No value given for home_server.");
+ "No value given for home_server");
return 0;
}
}
+int realm_pool_add(home_pool_t *pool, UNUSED CONF_SECTION *cs)
+{
+ /*
+ * The structs aren't mutex protected. Refuse to destroy
+ * the server.
+ */
+ if (realms_initialized && !realm_config->dynamic) {
+ DEBUG("Must set \"dynamic = true\" in proxy.conf");
+ return 0;
+ }
+
+ if (!rbtree_insert(home_pools_byname, pool)) {
+ rad_assert("Internal sanity check failed" == NULL);
+ return 0;
+ }
+
+ return 1;
+}
+
static int server_pool_add(realm_config_t *rc,
CONF_SECTION *cs, int server_type, int do_print)
{
if (!name2 || ((strcasecmp(name2, "server_pool") != 0) &&
(strcasecmp(name2, "home_server_pool") != 0))) {
cf_log_err_cs(cs,
- "Section is not a home_server_pool.");
+ "Section is not a home_server_pool");
return 0;
}
name2 = cf_section_name2(cs);
if (!name2) {
cf_log_err_cs(cs,
- "Server pool section is missing a name.");
+ "Server pool section is missing a name");
return 0;
}
if (!pool_check_home_server(rc, cp, cf_pair_value(cp),
server_type, &home)) {
+ DEBUG("SHIT %d", __LINE__);
return 0;
}
}
if (cp) {
#ifdef WITH_COA
if (server_type == HOME_TYPE_COA) {
- cf_log_err_cs(cs, "Home server pools of type \"coa\" cannot have a fallback virtual server.");
+ cf_log_err_cs(cs, "Home server pools of type \"coa\" cannot have a fallback virtual server");
goto error;
}
#endif
value = cf_pair_value(cp);
if (!value) {
cf_log_err_cp(cp,
- "No value given for type.");
+ "No value given for type");
goto error;
}
}
if (0) {
- WDEBUG2("Duplicate home server %s in server pool %s", home->name, pool->name);
+ WARN("Duplicate home server %s in server pool %s", home->name, pool->name);
continue;
}
cf_log_info(cs, "\tfallback = %s", pool->fallback->name);
}
- if (!rbtree_insert(home_pools_byname, pool)) {
- rad_assert("Internal sanity check failed");
- goto error;
- }
+ if (!realm_pool_add(pool, cs)) goto error;
if (do_print) cf_log_info(cs, " }");
q = NULL;
} else if (p == name) {
- cf_log_err_cs(cs,
- "Invalid hostname %s.",
- name);
- free(home);
- return 0;
-
+ cf_log_err_cs(cs, "Invalid hostname %s", name);
+ talloc_free(home);
+ return 0;
} else {
- home->port = atoi(p + 1);
- if ((home->port == 0) || (home->port > 65535)) {
- cf_log_err_cs(cs,
- "Invalid port %s.",
- p + 1);
- free(home);
+ unsigned long port = strtoul(p + 1, NULL, 0);
+ if ((port == 0) || (port > 65535)) {
+ cf_log_err_cs(cs, "Invalid port %s", p + 1);
+ talloc_free(home);
return 0;
}
- q = rad_malloc((p - name) + 1);
+ home->port = (uint16_t)port;
+ q = talloc_array(home, char, (p - name) + 1);
memcpy(q, name, (p - name));
q[p - name] = '\0';
p = q;
}
if (!server) {
- if (ip_hton(p, AF_UNSPEC, &home->ipaddr) < 0) {
+ if (ip_hton(&home->ipaddr, AF_UNSPEC, p, false) < 0) {
cf_log_err_cs(cs,
"Failed looking up hostname %s.",
p);
- free(home);
- free(q);
+ talloc_free(home);
+ talloc_free(q);
return 0;
}
home->src_ipaddr.af = home->ipaddr.af;
home->ipaddr.af = AF_UNSPEC;
home->server = server;
}
- free(q);
+ talloc_free(q);
/*
* Use the old-style configuration.
*/
home->max_outstanding = 65535*16;
home->zombie_period = rc->retry_delay * rc->retry_count;
- if (home->zombie_period == 0) home->zombie_period =30;
- home->response_window = home->zombie_period - 1;
+ if (home->zombie_period < 2) home->zombie_period = 30;
+ home->response_window.tv_sec = home->zombie_period - 1;
+ home->response_window.tv_usec = 0;
home->ping_check = HOME_PING_CHECK_NONE;
if (rbtree_finddata(home_servers_byaddr, home)) {
cf_log_err_cs(cs, "Home server %s has the same IP address and/or port as another home server.", name);
- free(home);
+ talloc_free(home);
return 0;
}
if (!rbtree_insert(home_servers_byname, home)) {
cf_log_err_cs(cs, "Internal error %d adding home server %s.", __LINE__, name);
- free(home);
+ talloc_free(home);
return 0;
}
if (!rbtree_insert(home_servers_byaddr, home)) {
rbtree_deletebydata(home_servers_byname, home);
cf_log_err_cs(cs, "Internal error %d adding home server %s.", __LINE__, name);
- free(home);
+ talloc_free(home);
return 0;
}
cf_log_err_cs(cs,
"Internal error %d adding home server %s.",
__LINE__, name);
- free(home);
+ talloc_free(home);
return 0;
}
#endif
if (num_home_servers == 0) {
cf_log_err_cs(cs, "Internal error counting pools for home server %s.", name);
- free(home);
+ talloc_free(home);
return 0;
}
pool->servers[0] = home;
if (!rbtree_insert(home_pools_byname, pool)) {
- rad_assert("Internal sanity check failed");
+ rad_assert("Internal sanity check failed" == NULL);
return 0;
}
name2 = cf_section_name1(cs);
if (!name2 || (strcasecmp(name2, "realm") != 0)) {
- cf_log_err_cs(cs, "Section is not a realm.");
+ cf_log_err_cs(cs, "Section is not a realm");
return 0;
}
name2 = cf_section_name2(cs);
if (!name2) {
- cf_log_err_cs(cs, "Realm section is missing the realm name.");
+ cf_log_err_cs(cs, "Realm section is missing the realm name");
return 0;
}
if (cp) auth_pool_name = cf_pair_value(cp);
if (cp && auth_pool_name) {
if (auth_pool) {
- cf_log_err_cs(cs, "Cannot use \"pool\" and \"auth_pool\" at the same time.");
+ cf_log_err_cs(cs, "Cannot use \"pool\" and \"auth_pool\" at the same time");
return 0;
}
if (!add_pool_to_realm(rc, cs,
bool do_print = true;
if (acct_pool) {
- cf_log_err_cs(cs, "Cannot use \"pool\" and \"acct_pool\" at the same time.");
+ cf_log_err_cs(cs, "Cannot use \"pool\" and \"acct_pool\" at the same time");
return 0;
}
}
#endif
-#ifdef HAVE_REGEX_H
- if (name2[0] == '~') {
- int rcode;
- regex_t reg;
-
- /*
- * Include substring matches.
- */
- rcode = regcomp(®, name2 + 1, REG_EXTENDED | REG_NOSUB | REG_ICASE);
- if (rcode != 0) {
- char buffer[256];
-
- regerror(rcode, ®, buffer, sizeof(buffer));
-
- cf_log_err_cs(cs,
- "Invalid regex \"%s\": %s",
- name2 + 1, buffer);
- goto error;
- }
- regfree(®);
- }
-#endif
-
r = rad_malloc(sizeof(*r));
memset(r, 0, sizeof(*r));
((cp = cf_pair_find(cs, "accthost")) != NULL) ||
((cp = cf_pair_find(cs, "secret")) != NULL) ||
((cp = cf_pair_find(cs, "ldflag")) != NULL)) {
- WDEBUG2("Ignoring old-style configuration entry \"%s\" in realm \"%s\"", cf_pair_attr(cp), r->name);
+ WARN("Ignoring old-style configuration entry \"%s\" in realm \"%s\"", cf_pair_attr(cp), r->name);
}
goto error;
}
+ if (!realm_realm_add(r, cs)) {
+ goto error;
+ }
+
+ cf_log_info(cs, " }");
+
+ return 1;
+
+ error:
+ cf_log_info(cs, " } # realm %s", name2);
+ free(r);
+ return 0;
+}
+
+
+int realm_realm_add(REALM *r, CONF_SECTION *cs)
+{
+ /*
+ * The structs aren't mutex protected. Refuse to destroy
+ * the server.
+ */
+ if (realms_initialized && !realm_config->dynamic) {
+ DEBUG("Must set \"dynamic = true\" in proxy.conf");
+ return 0;
+ }
+
#ifdef HAVE_REGEX_H
/*
- * It's a regex. Add it to a separate list.
+ * It's a regex. Sanity check it, and add it to a
+ * separate list.
*/
- if (name2[0] == '~') {
+ if (r->name[0] == '~') {
+ int rcode;
realm_regex_t *rr, **last;
+ regex_t reg;
+
+ /*
+ * Include substring matches.
+ */
+ rcode = regcomp(®, r->name + 1, REG_EXTENDED | REG_NOSUB | REG_ICASE);
+ if (rcode != 0) {
+ char buffer[256];
+
+ regerror(rcode, ®, buffer, sizeof(buffer));
+
+ cf_log_err_cs(cs,
+ "Invalid regex \"%s\": %s",
+ r->name + 1, buffer);
+ return 0;
+ }
+ regfree(®);
rr = rad_malloc(sizeof(*rr));
last = &realms_regex;
while (*last) last = &((*last)->next); /* O(N^2)... sue me. */
- r->name = name2;
rr->realm = r;
rr->next = NULL;
*last = rr;
-
- cf_log_info(cs, " }");
return 1;
}
#endif
if (!rbtree_insert(realms_byname, r)) {
- rad_assert("Internal sanity check failed");
- goto error;
+ rad_assert("Internal sanity check failed" == NULL);
+ return 0;
}
- cf_log_info(cs, " }");
-
return 1;
-
- error:
- cf_log_info(cs, " } # realm %s", name2);
- free(r);
- return 0;
}
#ifdef WITH_COA
int realms_init(CONF_SECTION *config)
{
CONF_SECTION *cs;
+ int flags = 0;
#ifdef WITH_PROXY
CONF_SECTION *server_cs;
#endif
- realm_config_t *rc, *old_rc;
-
- if (realms_byname) return 1;
-
- realms_byname = rbtree_create(realm_name_cmp, free, 0);
- if (!realms_byname) {
- realms_free();
- return 0;
- }
+ realm_config_t *rc;
-#ifdef WITH_PROXY
- home_servers_byaddr = rbtree_create(home_server_addr_cmp, home_server_free, 0);
- if (!home_servers_byaddr) {
- realms_free();
- return 0;
- }
-
- home_servers_byname = rbtree_create(home_server_name_cmp, NULL, 0);
- if (!home_servers_byname) {
- realms_free();
- return 0;
- }
-
-#ifdef WITH_STATS
- home_servers_bynumber = rbtree_create(home_server_number_cmp, NULL, 0);
- if (!home_servers_bynumber) {
- realms_free();
- return 0;
- }
-#endif
-
- home_pools_byname = rbtree_create(home_pool_name_cmp, NULL, 0);
- if (!home_pools_byname) {
- realms_free();
- return 0;
- }
-#endif
+ if (realms_initialized) return 1;
rc = talloc_zero(NULL, realm_config_t);
rc->cs = config;
rc->dead_time = DEAD_TIME;
rc->retry_count = RETRY_COUNT;
rc->retry_delay = RETRY_DELAY;
- rc->fallback = 0;
+ rc->fallback = false;
+ rc->dynamic = false;
rc->wake_all_if_all_dead= 0;
}
+ if (rc->dynamic) {
+ flags = RBTREE_FLAG_LOCK;
+ }
+
+ home_servers_byaddr = rbtree_create(NULL, home_server_addr_cmp, home_server_free, flags);
+ if (!home_servers_byaddr) goto error;
+
+ home_servers_byname = rbtree_create(NULL, home_server_name_cmp, NULL, flags);
+ if (!home_servers_byname) goto error;
+
+#ifdef WITH_STATS
+ home_servers_bynumber = rbtree_create(NULL, home_server_number_cmp, NULL, flags);
+ if (!home_servers_bynumber) goto error;
+#endif
+
+ home_pools_byname = rbtree_create(NULL, home_pool_name_cmp, NULL, flags);
+ if (!home_pools_byname) goto error;
+
for (cs = cf_subsection_find_next(config, NULL, "home_server");
cs != NULL;
cs = cf_subsection_find_next(config, cs, "home_server")) {
}
/*
- * Loop over virtual servers to find homes which are
- * defined in them.
+ * Loop over virtual servers to find home servers which
+ * are defined in them.
*/
for (server_cs = cf_subsection_find_next(config, NULL, "server");
server_cs != NULL;
}
#endif
+ /*
+ * Now create the realms, which point to the home servers
+ * and home server pools.
+ */
+ realms_byname = rbtree_create(NULL, realm_name_cmp, NULL, flags);
+ if (!realms_byname) goto error;
+
for (cs = cf_subsection_find_next(config, NULL, "realm");
cs != NULL;
cs = cf_subsection_find_next(config, cs, "realm")) {
if (!realm_add(rc, cs)) {
-#if defined (WITH_PROXY) || defined (WITH_COA)
error:
-#endif
realms_free();
/*
* Must be called after realms_free as home_servers
}
#endif
-
#ifdef WITH_PROXY
xlat_register("home_server", xlat_home_server, NULL, NULL);
xlat_register("home_server_pool", xlat_server_pool, NULL, NULL);
#endif
- /*
- * Swap pointers atomically.
- */
- old_rc = realm_config;
realm_config = rc;
- talloc_free(old_rc);
-
+ realms_initialized = true;
return 1;
}
* Access-Requests have a Message-Authenticator added,
* unless one already exists.
*/
- if ((request->packet->code == PW_CODE_AUTHENTICATION_REQUEST) &&
+ if ((request->packet->code == PW_CODE_ACCESS_REQUEST) &&
!pairfind(request->proxy->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY)) {
pairmake(request->proxy, &request->proxy->vps,
"Message-Authenticator", "0x00",
if (!found && pool->fallback) {
found = pool->fallback;
- WDEBUG("Home server pool %s failing over to fallback %s",
+ WARN("Home server pool %s failing over to fallback %s",
pool->name, found->server);
if (pool->in_fallback) goto update_and_return;
if ((home->state == HOME_STATE_IS_DEAD) &&
(home->ping_check == HOME_PING_CHECK_NONE)) {
home->state = HOME_STATE_ALIVE;
+ home->response_timeouts = 0;
if (!found) found = home;
}
}
if (!rd) return NULL;
pool = NULL;
- if (request->packet->code == PW_CODE_AUTHENTICATION_REQUEST) {
+ if (request->packet->code == PW_CODE_ACCESS_REQUEST) {
pool = rd->auth_pool;
} else if (request->packet->code == PW_CODE_ACCOUNTING_REQUEST) {
}
-home_server_t *home_server_find(fr_ipaddr_t *ipaddr, int port, int proto)
+home_server_t *home_server_find(fr_ipaddr_t *ipaddr, uint16_t port, int proto)
{
home_server_t myhome;
projects / freeradius.git / blobdiff