X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=src%2Fmain%2Frealms.c;h=37ceb48fb55e737d1b313785f2c3a0ad6d740eff;hb=bca85674a83f94b9cfae0ebdc129bbaf645c8f7d;hp=38b06be0735075fdda604e14a39398b2f213baeb;hpb=3ac766b9e5f3ef71b4cf0bfd2e8b59de4aab06b5;p=freeradius.git

diff --git a/src/main/realms.c b/src/main/realms.c
index 38b06be..37ceb48 100644
--- a/src/main/realms.c
+++ b/src/main/realms.c
@@ -142,12 +142,18 @@ static int home_server_addr_cmp(const void *one, const void *two)
 
 	if (a->server && !b->server) return -1;
 	if (!a->server && b->server) return +1;
+
 	if (a->server && b->server) {
 		int rcode = a->type - b->type;
 		if (rcode != 0) return rcode;
 		return strcmp(a->server, b->server);
 	}
 
+#ifdef WITH_TCP
+	if (a->proto < b->proto) return -1;
+	if (a->proto > b->proto) return +1;
+#endif
+
 	if (a->port < b->port) return -1;
 	if (a->port > b->port) return +1;
 
@@ -176,6 +182,36 @@ static int home_pool_name_cmp(const void *one, const void *two)
 }
 
 
+static size_t xlat_cs(CONF_SECTION *cs, char *fmt, char *out, size_t outlen)
+
+{
+	const char *value = NULL;
+
+	/*
+	 *	Instance name
+	 */
+	if (strcmp(fmt, "instance") == 0) {
+		value = cf_section_name2(cs);
+		if (!value) {
+			*out = '\0';
+			return 0;
+		}
+	} else {
+		CONF_PAIR *cp;
+
+		cp = cf_pair_find(cs, fmt);
+		if (!cp || !(value = cf_pair_value(cp))) {
+			*out = '\0';
+			return 0;
+		}
+	}
+
+	strlcpy(out, value, outlen);
+
+	return strlen(out);
+}
+
+
 /*
  *	Xlat for %{home_server:foo}
  */
@@ -183,9 +219,6 @@ static size_t xlat_home_server(UNUSED void *instance, REQUEST *request,
 			       char *fmt, char *out, size_t outlen,
 			       UNUSED RADIUS_ESCAPE_STRING func)
 {
-	const char *value = NULL;
-	CONF_PAIR *cp;
-
 	if (!fmt || !out || (outlen < 1)) return 0;
 
 	if (!request || !request->home_server) {
@@ -193,15 +226,7 @@ static size_t xlat_home_server(UNUSED void *instance, REQUEST *request,
 		return 0;
 	}
 
-	cp = cf_pair_find(request->home_server->cs, fmt);
-	if (!cp || !(value = cf_pair_value(cp))) {
-		*out = '\0';
-		return 0;
-	}
-	
-	strlcpy(out, value, outlen);
-
-	return strlen(out);
+	return xlat_cs(request->home_server->cs, fmt, out, outlen);
 }
 
 
@@ -212,9 +237,6 @@ static size_t xlat_server_pool(UNUSED void *instance, REQUEST *request,
 			       char *fmt, char *out, size_t outlen,
 			       UNUSED RADIUS_ESCAPE_STRING func)
 {
-	const char *value = NULL;
-	CONF_PAIR *cp;
-
 	if (!fmt || !out || (outlen < 1)) return 0;
 
 	if (!request || !request->home_pool) {
@@ -222,15 +244,7 @@ static size_t xlat_server_pool(UNUSED void *instance, REQUEST *request,
 		return 0;
 	}
 
-	cp = cf_pair_find(request->home_pool->cs, fmt);
-	if (!cp || !(value = cf_pair_value(cp))) {
-		*out = '\0';
-		return 0;
-	}
-	
-	strlcpy(out, value, outlen);
-
-	return strlen(out);
+	return xlat_cs(request->home_pool->cs, fmt, out, outlen);
 }
 #endif
 
@@ -264,19 +278,41 @@ void realms_free(void)
 			free(this->realm);
 			free(this);
 		}
+		realms_regex = NULL;
 	}
 #endif
 
 	free(realm_config);
+	realm_config = NULL;
 }
 
 
 #ifdef WITH_PROXY
+static CONF_PARSER limit_config[] = {
+	{ "max_connections", PW_TYPE_INTEGER,
+	  offsetof(home_server, max_connections), NULL,   "16" },
+
+	{ "max_requests", PW_TYPE_INTEGER,
+	  offsetof(home_server,max_requests), NULL,   "0" },
+
+	{ "lifetime", PW_TYPE_INTEGER,
+	  offsetof(home_server,lifetime), NULL,   "0" },
+
+	{ "idle_timeout", PW_TYPE_INTEGER,
+	  offsetof(home_server,idle_timeout), NULL,   "0" },
+
+	{ NULL, -1, 0, NULL, NULL }		/* end the list */
+};
+
 static struct in_addr hs_ip4addr;
 static struct in6_addr hs_ip6addr;
+static char *hs_srcipaddr = NULL;
 static char *hs_type = NULL;
 static char *hs_check = NULL;
 static char *hs_virtual_server = NULL;
+#ifdef WITH_TCP
+static char *hs_proto = NULL;
+#endif
 
 static CONF_PARSER home_server_config[] = {
 	{ "ipaddr",  PW_TYPE_IPADDR,
@@ -292,13 +328,25 @@ static CONF_PARSER home_server_config[] = {
 	{ "type",  PW_TYPE_STRING_PTR,
 	  0, &hs_type, NULL },
 
+#ifdef WITH_TCP
+	{ "proto",  PW_TYPE_STRING_PTR,
+	  0, &hs_proto, NULL },
+#endif
+
 	{ "secret",  PW_TYPE_STRING_PTR,
 	  offsetof(home_server,secret), NULL,  NULL},
 
+	{ "src_ipaddr",  PW_TYPE_STRING_PTR,
+	  0, &hs_srcipaddr,  NULL },
+
 	{ "response_window", PW_TYPE_INTEGER,
 	  offsetof(home_server,response_window), NULL,   "30" },
+	{ "no_response_fail", PW_TYPE_BOOLEAN,
+	  offsetof(home_server,no_response_fail), NULL,   NULL },
 	{ "max_outstanding", PW_TYPE_INTEGER,
 	  offsetof(home_server,max_outstanding), NULL,   "65536" },
+	{ "require_message_authenticator",  PW_TYPE_BOOLEAN,
+	  offsetof(home_server, message_authenticator), 0, NULL },
 
 	{ "zombie_period", PW_TYPE_INTEGER,
 	  offsetof(home_server,zombie_period), NULL,   "40" },
@@ -330,12 +378,28 @@ static CONF_PARSER home_server_config[] = {
 	  offsetof(home_server,ema.window), NULL,  NULL },
 #endif
 
-	{ NULL, -1, 0, NULL, NULL }		/* end the list */
+#ifdef WITH_COA
+	{ "irt",  PW_TYPE_INTEGER,
+	  offsetof(home_server, coa_irt), 0, Stringify(2) },
+	{ "mrt",  PW_TYPE_INTEGER,
+	  offsetof(home_server, coa_mrt), 0, Stringify(16) },
+	{ "mrc",  PW_TYPE_INTEGER,
+	  offsetof(home_server, coa_mrc), 0, Stringify(5) },
+	{ "mrd",  PW_TYPE_INTEGER,
+	  offsetof(home_server, coa_mrd), 0, Stringify(30) },
+#endif
+
+	{ "limit", PW_TYPE_SUBSECTION, 0, NULL, (const void *) limit_config },
 
+	{ NULL, -1, 0, NULL, NULL }		/* end the list */
 };
 
 
-static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int type)
+static void null_free(UNUSED void *data)
+{
+}
+
+static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int pool_type)
 {
 	const char *name2;
 	home_server *home;
@@ -365,9 +429,29 @@ static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int type)
 	home->name = name2;
 	home->cs = cs;
 
+        /*
+	 *      For zombie period calculations.  We want to count
+	 *      zombies from the time when the server starts, instead
+	 *      of from 1970.
+	 */
+	home->last_packet = time(NULL);
+
+	/*
+	 *	Authentication servers have a default "no_response_fail = 0".
+	 *	Accounting servers have a default "no_response_fail = 1".
+	 *
+	 *	This is because authentication packets are retried, so
+	 *	they can fail over to another home server.  Accounting
+	 *	packets are not retried, so they cannot fail over, and
+	 *	instead should be rejected immediately.
+	 */
+	home->no_response_fail = 2;
+
 	memset(&hs_ip4addr, 0, sizeof(hs_ip4addr));
 	memset(&hs_ip6addr, 0, sizeof(hs_ip6addr));
-	cf_section_parse(cs, home, home_server_config);
+	if (cf_section_parse(cs, home, home_server_config) < 0) {
+		goto error;
+	}
 
 	/*
 	 *	Figure out which one to use.
@@ -396,8 +480,11 @@ static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int type)
 			goto error;
 		}
 
-		free(hs_type);
-		hs_type = NULL;
+		/*
+		 *	When CoA is used, the user has to specify the type
+		 *	of the home server, even when they point to
+		 *	virtual servers.
+		 */
 		home->secret = strdup("");
 		goto skip_port;
 
@@ -411,6 +498,12 @@ static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int type)
 		hs_type = NULL;
 		free(hs_check);
 		hs_check = NULL;
+		free(hs_srcipaddr);
+		hs_srcipaddr = NULL;
+#ifdef WITH_TCP
+		free(hs_proto);
+		hs_proto = NULL;
+#endif
 		return 0;
 	}
 
@@ -432,8 +525,7 @@ static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int type)
 		cf_log_err(cf_sectiontoitem(cs),
 			   "No shared secret defined for home server %s.",
 			   name2);
-		free(home);
-		return 0;
+		goto error;
 	}
 
 	/*
@@ -444,38 +536,43 @@ static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int type)
 
 	if (strcasecmp(hs_type, "auth") == 0) {
 		home->type = HOME_TYPE_AUTH;
-		if (type != home->type) {
+		if (home->no_response_fail == 2) home->no_response_fail = 0;
+		if (pool_type != home->type) {
+		mismatch:
 			cf_log_err(cf_sectiontoitem(cs),
-				   "Server pool of \"acct\" servers cannot include home server %s of type \"auth\"",
-				   name2);
-			free(home);
-			return 0;
+				   "Home server %s of unexpected type \"%s\"",
+				   name2, hs_type);
+			goto error;
 		}
 
 	} else if (strcasecmp(hs_type, "acct") == 0) {
 		home->type = HOME_TYPE_ACCT;
-		if (type != home->type) {
-			cf_log_err(cf_sectiontoitem(cs),
-				   "Server pool of \"auth\" servers cannot include home server %s of type \"acct\"",
-				   name2);
-			free(home);
-			return 0;
-		}
+		if (home->no_response_fail == 2) home->no_response_fail = 1;
+		if (pool_type != home->type) goto mismatch;
 
 	} else if (strcasecmp(hs_type, "auth+acct") == 0) {
 		home->type = HOME_TYPE_AUTH;
 		dual = TRUE;
 
+#ifdef WITH_COA
+	} else if (strcasecmp(hs_type, "coa") == 0) {
+		home->type = HOME_TYPE_COA;
+		dual = FALSE;
+
+		if (pool_type != home->type) goto mismatch;
+
+		if (home->server != NULL) {
+			cf_log_err(cf_sectiontoitem(cs),
+				   "Home servers of type \"coa\" cannot point to a virtual server");
+			goto error;
+		}
+#endif
+
 	} else {
 		cf_log_err(cf_sectiontoitem(cs),
 			   "Invalid type \"%s\" for home server %s.",
 			   hs_type, name2);
-		free(home);
-		free(hs_type);
-		hs_type = NULL;
-		free(hs_check);
-		hs_check = NULL;
-		return 0;
+		goto error;
 	}
 	free(hs_type);
 	hs_type = NULL;
@@ -493,10 +590,7 @@ static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int type)
 		cf_log_err(cf_sectiontoitem(cs),
 			   "Invalid ping_check \"%s\" for home server %s.",
 			   hs_check, name2);
-		free(home);
-		free(hs_check);
-		hs_check = NULL;
-		return 0;
+		goto error;
 	}
 	free(hs_check);
 	hs_check = NULL;
@@ -505,40 +599,84 @@ static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int type)
 	    (home->ping_check != HOME_PING_CHECK_STATUS_SERVER)) {
 		if (!home->ping_user_name) {
 			cf_log_err(cf_sectiontoitem(cs), "You must supply a user name to enable ping checks");
-			free(home);
-			return 0;
+			goto error;
 		}
 
 		if ((home->type == HOME_TYPE_AUTH) &&
 		    !home->ping_user_password) {
 			cf_log_err(cf_sectiontoitem(cs), "You must supply a password to enable ping checks");
-			free(home);
-			return 0;
+			goto error;
 		}
 	}
 
-	if ((home->ipaddr.af != AF_UNSPEC) && /* could be virtual server */
+	home->proto = IPPROTO_UDP;
+#ifdef WITH_TCP
+	if (hs_proto) {
+		if (strcmp(hs_proto, "udp") == 0) {
+			free(hs_proto);
+			hs_proto = NULL;
+			
+		} else if (strcmp(hs_proto, "tcp") == 0) {
+			free(hs_proto);
+			hs_proto = NULL;
+			home->proto = IPPROTO_TCP;
+			
+		} else {
+			cf_log_err(cf_sectiontoitem(cs),
+				   "Unknown proto \"%s\".", hs_proto);
+			goto error;
+		}
+	}
+#endif
+
+	if (!home->server &&
 	    rbtree_finddata(home_servers_byaddr, home)) {
-		DEBUG2("Ignoring duplicate home server %s.", name2);
-		return 1;
+		cf_log_err(cf_sectiontoitem(cs), "Duplicate home server");
+		goto error;
+	}
+
+	/*
+	 *	If the home is a virtual server, don't look up source IP.
+	 */
+	if (!home->server) {
+		rad_assert(home->ipaddr.af != AF_UNSPEC);
+
+		/*
+		 *	Otherwise look up the source IP using the same
+		 *	address family as the destination IP.
+		 */
+		if (hs_srcipaddr) {
+			if (ip_hton(hs_srcipaddr, home->ipaddr.af, &home->src_ipaddr) < 0) {
+				cf_log_err(cf_sectiontoitem(cs), "Failed parsing src_ipaddr");
+				goto error;
+			}
+			
+		} else {
+			/*
+			 *	Source isn't specified: Source is
+			 *	the correct address family, but all zeros.
+			 */
+			home->src_ipaddr.af = home->ipaddr.af;
+		}
 	}
 
+	free(hs_srcipaddr);
+	hs_srcipaddr = NULL;
+
 	if (!rbtree_insert(home_servers_byname, home)) {
 		cf_log_err(cf_sectiontoitem(cs),
 			   "Internal error %d adding home server %s.",
 			   __LINE__, name2);
-		free(home);
-		return 0;
+		goto error;
 	}
 
-	if ((home->ipaddr.af != AF_UNSPEC) && /* could be virtual server */
+	if (!home->server &&
 	    !rbtree_insert(home_servers_byaddr, home)) {
 		rbtree_deletebydata(home_servers_byname, home);
 		cf_log_err(cf_sectiontoitem(cs),
 			   "Internal error %d adding home server %s.",
 			   __LINE__, name2);
-		free(home);
-		return 0;
+		goto error;
 	}
 
 #ifdef WITH_STATS
@@ -551,21 +689,20 @@ static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int type)
 		cf_log_err(cf_sectiontoitem(cs),
 			   "Internal error %d adding home server %s.",
 			   __LINE__, name2);
-		free(home);
-		return 0;
+		goto error;
 	}
 #endif
 
-	if (home->response_window < 5) home->response_window = 5;
-	if (home->response_window > 60) home->response_window = 60;
-
 	if (home->max_outstanding < 8) home->max_outstanding = 8;
 	if (home->max_outstanding > 65536*16) home->max_outstanding = 65536*16;
 
 	if (home->ping_interval < 6) home->ping_interval = 6;
 	if (home->ping_interval > 120) home->ping_interval = 120;
 
-	if (home->zombie_period < 20) home->zombie_period = 20;
+	if (home->response_window < 1) home->response_window = 1;
+	if (home->response_window > 60) home->response_window = 60;
+
+	if (home->zombie_period < 1) home->zombie_period = 1;
 	if (home->zombie_period > 120) home->zombie_period = 120;
 
 	if (home->zombie_period < home->response_window) {
@@ -581,6 +718,36 @@ static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int type)
 	if (home->revive_interval < 60) home->revive_interval = 60;
 	if (home->revive_interval > 3600) home->revive_interval = 3600;
 
+#ifdef WITH_COA
+	if (home->coa_irt < 1) home->coa_irt = 1;
+	if (home->coa_irt > 5) home->coa_irt = 5;
+
+	if (home->coa_mrc < 0) home->coa_mrc = 0;
+	if (home->coa_mrc > 20 ) home->coa_mrc = 20;
+
+	if (home->coa_mrt < 0) home->coa_mrt = 0;
+	if (home->coa_mrt > 30 ) home->coa_mrt = 30;
+
+	if (home->coa_mrd < 5) home->coa_mrd = 5;
+	if (home->coa_mrd > 60 ) home->coa_mrd = 60;
+#endif
+
+	if (home->max_connections > 1024) home->max_connections = 1024;
+
+#ifdef WITH_TCP
+	/*
+	 *	UDP sockets can't be connection limited.
+	 */
+	if (home->proto != IPPROTO_TCP) home->max_connections = 0;
+#endif
+
+	if ((home->idle_timeout > 0) && (home->idle_timeout < 5))
+		home->idle_timeout = 5;
+	if ((home->lifetime > 0) && (home->lifetime < 5))
+		home->lifetime = 5;
+	if ((home->lifetime > 0) && (home->idle_timeout > home->lifetime))
+		home->idle_timeout = 0;
+
 	if (dual) {
 		home_server *home2 = rad_malloc(sizeof(*home2));
 
@@ -591,6 +758,9 @@ static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int type)
 		home2->ping_user_password = NULL;
 		home2->cs = cs;
 
+		if (home->no_response_fail == 2) home->no_response_fail = 0;
+		if (home2->no_response_fail == 2) home2->no_response_fail = 1;
+
 		if (!rbtree_insert(home_servers_byname, home2)) {
 			cf_log_err(cf_sectiontoitem(cs),
 				   "Internal error %d adding home server %s.",
@@ -599,7 +769,7 @@ static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int type)
 			return 0;
 		}
 		
-		if ((home->ipaddr.af != AF_UNSPEC) &&
+		if (!home->server &&
 		    !rbtree_insert(home_servers_byaddr, home2)) {
 			rbtree_deletebydata(home_servers_byname, home2);
 			cf_log_err(cf_sectiontoitem(cs),
@@ -613,7 +783,7 @@ static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int type)
 		home2->number = home_server_max_number++;
 		if (!rbtree_insert(home_servers_bynumber, home2)) {
 			rbtree_deletebydata(home_servers_byname, home2);
-			if (home2->ipaddr.af != AF_UNSPEC) {
+			if (!home2->server) {
 				rbtree_deletebydata(home_servers_byname, home2);
 			}
 			cf_log_err(cf_sectiontoitem(cs),
@@ -625,6 +795,11 @@ static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int type)
 #endif
 	}
 
+	/*
+	 *	Mark it as already processed
+	 */
+	cf_data_add(cs, "home_server", null_free, null_free);
+
 	return 1;
 }
 
@@ -683,8 +858,9 @@ static int pool_check_home_server(realm_config_t *rc, CONF_PAIR *cp,
 	
 	home = rbtree_finddata(home_servers_byname, &myhome);
 	if (!home) {
-		radlog(L_ERR, "Internal sanity check failed %d",
-		       __LINE__);
+		cf_log_err(cf_pairtoitem(cp),
+			   "Internal error %d adding home server \"%s\".",
+			   __LINE__, name);
 		return 0;
 	}
 
@@ -729,7 +905,6 @@ static int server_pool_add(realm_config_t *rc,
 
 		if (!pool_check_home_server(rc, cp, cf_pair_value(cp),
 					    server_type, &home)) {
-					    
 			return 0;
 		}
 	}
@@ -752,6 +927,13 @@ static int server_pool_add(realm_config_t *rc,
 	 */
 	cp = cf_pair_find(cs, "fallback");
 	if (cp) {
+#ifdef WITH_COA
+		if (server_type == HOME_TYPE_COA) {
+			cf_log_err(cf_sectiontoitem(cs), "Home server pools of type \"coa\" cannot have a fallback virtual server.");
+			goto error;
+		}
+#endif
+
 		if (!pool_check_home_server(rc, cp, cf_pair_value(cp),
 					    server_type, &pool->fallback)) {
 			
@@ -799,8 +981,13 @@ static int server_pool_add(realm_config_t *rc,
 
 	cp = cf_pair_find(cs, "virtual_server");
 	if (cp) {
-		pool->virtual_server = cf_pair_value(cp);
-		if (do_print && pool->virtual_server) {
+		pool->virtual_server = cf_pair_value(cp);		
+		if (!pool->virtual_server) {
+			cf_log_err(cf_pairtoitem(cp), "No value given for virtual_server");
+			goto error;
+		}
+
+		if (do_print) {
 			cf_log_info(cs, "\tvirtual_server = %s", pool->virtual_server);
 		}
 
@@ -851,6 +1038,8 @@ static int server_pool_add(realm_config_t *rc,
 
 	if (do_print) cf_log_info(cs, " }");
 
+	cf_data_add(cs, "home_server_pool", pool, free);
+
 	rad_assert(pool->server_type != 0);
 
 	return 1;
@@ -916,7 +1105,7 @@ static int old_server_add(realm_config_t *rc, CONF_SECTION *cs,
 	myhome.type = type;
 	home = rbtree_finddata(home_servers_byname, &myhome);
 	if (home) {
-		if (strcmp(home->secret, secret) != 0) {
+		if (secret && (strcmp(home->secret, secret) != 0)) {
 			cf_log_err(cf_sectiontoitem(cs), "Inconsistent shared secret for home server \"%s\"", name);
 			return 0;
 		}
@@ -977,6 +1166,7 @@ static int old_server_add(realm_config_t *rc, CONF_SECTION *cs,
 		home->type = type;
 		home->secret = secret;
 		home->cs = cs;
+		home->proto = IPPROTO_UDP;
 
 		p = strchr(name, ':');
 		if (!p) {
@@ -1021,6 +1211,7 @@ static int old_server_add(realm_config_t *rc, CONF_SECTION *cs,
 				free(q);
 				return 0;
 			}
+			home->src_ipaddr.af = home->ipaddr.af;
 		} else {
 			home->ipaddr.af = AF_UNSPEC;
 			home->server = server;
@@ -1405,15 +1596,22 @@ static int realm_add(realm_config_t *rc, CONF_SECTION *cs)
 
 #ifdef HAVE_REGEX_H
 	if (name2[0] == '~') {
+		int rcode;
 		regex_t reg;
 		
 		/*
 		 *	Include substring matches.
 		 */
-		if (regcomp(&reg, name2 + 1,
-			    REG_EXTENDED | REG_NOSUB | REG_ICASE) != 0) {
+		rcode = regcomp(&reg, name2 + 1,
+				REG_EXTENDED | REG_NOSUB | REG_ICASE);
+		if (rcode != 0) {
+			char buffer[256];
+
+			regerror(rcode, &reg, buffer, sizeof(buffer));
+
 			cf_log_err(cf_sectiontoitem(cs),
-				   "Invalid regex in realm \"%s\"", name2);
+				   "Invalid regex \"%s\": %s",
+				   name2 + 1, buffer);
 			goto error;
 		}
 		regfree(&reg);
@@ -1504,6 +1702,61 @@ static int realm_add(realm_config_t *rc, CONF_SECTION *cs)
 	return 0;
 }
 
+#ifdef WITH_COA
+static const FR_NAME_NUMBER home_server_types[] = {
+	{ "auth", HOME_TYPE_AUTH },
+	{ "auth+acct", HOME_TYPE_AUTH },
+	{ "acct", HOME_TYPE_ACCT },
+	{ "coa", HOME_TYPE_COA },
+	{ NULL, 0 }
+};
+
+static int pool_peek_type(CONF_SECTION *config, CONF_SECTION *cs)
+{
+	int home;
+	const char *name, *type;
+	CONF_PAIR *cp;
+	CONF_SECTION *server_cs;
+
+	cp = cf_pair_find(cs, "home_server");
+	if (!cp) {
+		cf_log_err(cf_sectiontoitem(cs), "Pool does not contain a \"home_server\" entry");
+		return HOME_TYPE_INVALID;
+	}
+
+	name = cf_pair_value(cp);
+	if (!name) {
+		cf_log_err(cf_pairtoitem(cp), "home_server entry does not reference a home server");
+		return HOME_TYPE_INVALID;
+	}
+
+	server_cs = cf_section_sub_find_name2(config, "home_server", name);
+	if (!server_cs) {
+		cf_log_err(cf_pairtoitem(cp), "home_server \"%s\" does not exist", name);
+		return HOME_TYPE_INVALID;
+	}
+
+	cp = cf_pair_find(server_cs, "type");
+	if (!cp) {
+		cf_log_err(cf_sectiontoitem(server_cs), "home_server %s does not contain a \"type\" entry", name);
+		return HOME_TYPE_INVALID;
+	}
+
+	type = cf_pair_value(cp);
+	if (!type) {
+		cf_log_err(cf_sectiontoitem(server_cs), "home_server %s contains an empty \"type\" entry", name);
+		return HOME_TYPE_INVALID;
+	}
+
+	home = fr_str2int(home_server_types, type, HOME_TYPE_INVALID);
+	if (home == HOME_TYPE_INVALID) {
+		cf_log_err(cf_sectiontoitem(server_cs), "home_server %s contains an invalid \"type\" entry of value \"%s\"", name, type);
+		return HOME_TYPE_INVALID;
+	}
+
+	return home;		/* 'cause we miss it so much */
+}
+#endif
 
 int realms_init(CONF_SECTION *config)
 {
@@ -1539,7 +1792,7 @@ int realms_init(CONF_SECTION *config)
 	}
 #endif
 
-	home_pools_byname = rbtree_create(home_pool_name_cmp, free, 0);
+	home_pools_byname = rbtree_create(home_pool_name_cmp, NULL, 0);
 	if (!home_pools_byname) {
 		realms_free();
 		return 0;
@@ -1573,6 +1826,46 @@ int realms_init(CONF_SECTION *config)
 		}
 	}
 
+#ifdef WITH_COA
+	/*
+	 *	CoA pools aren't tied to realms.
+	 */
+	for (cs = cf_subsection_find_next(config, NULL, "home_server_pool");
+	     cs != NULL;
+	     cs = cf_subsection_find_next(config, cs, "home_server_pool")) {
+		int type;
+
+		/*
+		 *	Pool was already loaded.
+		 */
+		if (cf_data_find(cs, "home_server_pool")) continue;
+
+		type = pool_peek_type(config, cs);
+		if (type == HOME_TYPE_INVALID) return 0;
+
+		if (!server_pool_add(rc, cs, type, TRUE)) {
+			return 0;
+		}
+	}
+
+	/*
+	 *	CoA home servers aren't tied to realms.
+	 */
+	for (cs = cf_subsection_find_next(config, NULL, "home_server");
+	     cs != NULL;
+	     cs = cf_subsection_find_next(config, cs, "home_server")) {
+		/*
+		 *	Server was already loaded.
+		 */
+		if (cf_data_find(cs, "home_server")) continue;
+
+		if (!home_server_add(rc, cs, HOME_TYPE_COA)) {
+			return 0;
+		}
+	}
+#endif
+
+
 #ifdef WITH_PROXY
 	xlat_register("home_server", xlat_home_server, NULL);
 	xlat_register("home_server_pool", xlat_server_pool, NULL);
@@ -1675,10 +1968,9 @@ home_server *home_server_ldb(const char *realmname,
 	int		start;
 	int		count;
 	home_server	*found = NULL;
+	home_server	*zombie = NULL;
 	VALUE_PAIR	*vp;
 
-	start = 0;
-
 	/*
 	 *	Determine how to pick choose the home server.
 	 */
@@ -1730,7 +2022,7 @@ home_server *home_server_ldb(const char *realmname,
 		break;
 
 	case HOME_POOL_KEYED_BALANCE:
-		if ((vp = pairfind(request->config_items, PW_LOAD_BALANCE_KEY)) != NULL) {
+		if ((vp = pairfind(request->config_items, PW_LOAD_BALANCE_KEY, 0)) != NULL) {
 			hash = fr_hash(vp->vp_strvalue, vp->length);
 			start = hash % pool->num_home_servers;
 			break;
@@ -1738,11 +2030,14 @@ home_server *home_server_ldb(const char *realmname,
 		/* FALL-THROUGH */
 				
 	case HOME_POOL_LOAD_BALANCE:
-		found = pool->servers[0];
+	case HOME_POOL_FAIL_OVER:
+		start = 0;
+		break;
 
-	default:
+	default:		/* this shouldn't happen... */
 		start = 0;
 		break;
+
 	}
 
 	/*
@@ -1755,6 +2050,11 @@ home_server *home_server_ldb(const char *realmname,
 	for (count = 0; count < pool->num_home_servers; count++) {
 		home_server *home = pool->servers[(start + count) % pool->num_home_servers];
 
+		if (!home) continue;
+
+		/*
+		 *	Skip dead home servers.
+		 */
 		if (home->state == HOME_STATE_IS_DEAD) {
 			continue;
 		}
@@ -1766,8 +2066,44 @@ home_server *home_server_ldb(const char *realmname,
 			continue;
 		}
 
+#ifdef WITH_DETAIL
+		/*
+		 *	We read the packet from a detail file, AND it
+		 *	came from this server.  Don't re-proxy it
+		 *	there.
+		 */
+		if ((request->listener->type == RAD_LISTEN_DETAIL) &&
+		    (request->packet->code == PW_ACCOUNTING_REQUEST) &&
+		    (fr_ipaddr_cmp(&home->ipaddr, &request->packet->src_ipaddr) == 0)) {
+			continue;
+		}
+#endif
+
+		/*
+		 *	It's zombie, so we remember the first zombie
+		 *	we find, but we don't mark it as a "live"
+		 *	server.
+		 */
+		if (home->state == HOME_STATE_ZOMBIE) {
+			if (!zombie) zombie = home;
+			continue;
+		}
+
+		/*
+		 *	We've found the first "live" one.  Use that.
+		 */
 		if (pool->type != HOME_POOL_LOAD_BALANCE) {
-			return home;
+			found = home;
+			break;
+		}
+
+		/*
+		 *	Otherwise we're doing some kind of load balancing.
+		 *	If we haven't found one yet, pick this one.
+		 */
+		if (!found) {
+			found = home;
+			continue;
 		}
 
 		RDEBUG3("PROXY %s %d\t%s %d",
@@ -1776,7 +2112,7 @@ home_server *home_server_ldb(const char *realmname,
 
 		/*
 		 *	Prefer this server if it's less busy than the
-		 *	one we previously found.
+		 *	one we had previously found.
 		 */
 		if (home->currently_outstanding < found->currently_outstanding) {
 			RDEBUG3("PROXY Choosing %s: It's less busy than %s",
@@ -1802,16 +2138,86 @@ home_server *home_server_ldb(const char *realmname,
 		if (((count + 1) * (fr_rand() & 0xffff)) < (uint32_t) 0x10000) {
 			found = home;
 		}
-
 	} /* loop over the home servers */
 
-	if (found) return found;
+	/*
+	 *	We have no live servers, BUT we have a zombie.  Use
+	 *	the zombie as a last resort.
+	 */
+	if (!found && zombie) {
+		found = zombie;
+		zombie = NULL;
+	}
 
 	/*
 	 *	There's a fallback if they're all dead.
 	 */
-	if (pool->fallback) {
-		return pool->fallback;
+	if (!found && pool->fallback) {
+		found = pool->fallback;
+	}
+
+	if (found) {
+	update_and_return:
+		/*
+		 *	Allocate the proxy packet, only if it wasn't
+		 *	already allocated by a module.  This check is
+		 *	mainly to support the proxying of EAP-TTLS and
+		 *	EAP-PEAP tunneled requests.
+		 *
+		 *	In those cases, the EAP module creates a
+		 *	"fake" request, and recursively passes it
+		 *	through the authentication stage of the
+		 *	server.  The module then checks if the request
+		 *	was supposed to be proxied, and if so, creates
+		 *	a proxy packet from the TUNNELED request, and
+		 *	not from the EAP request outside of the
+		 *	tunnel.
+		 *
+		 *	The proxy then works like normal, except that
+		 *	the response packet is "eaten" by the EAP
+		 *	module, and encapsulated into an EAP packet.
+		 */
+		if (!request->proxy) {
+			if ((request->proxy = rad_alloc(TRUE)) == NULL) {
+				radlog(L_ERR|L_CONS, "no memory");
+				exit(1);
+			}
+			
+			/*
+			 *	Copy the request, then look up name
+			 *	and plain-text password in the copy.
+			 *
+			 *	Note that the User-Name attribute is
+			 *	the *original* as sent over by the
+			 *	client.  The Stripped-User-Name
+			 *	attribute is the one hacked through
+			 *	the 'hints' file.
+			 */
+			request->proxy->vps =  paircopy(request->packet->vps);
+		}
+
+		/*
+		 *	Update the various fields as appropriate.
+		 */
+		request->proxy->src_ipaddr = found->src_ipaddr;
+		request->proxy->src_port = 0;
+		request->proxy->dst_ipaddr = found->ipaddr;
+		request->proxy->dst_port = found->port;
+		request->home_server = found;
+
+		/*
+		 *	We're supposed to add a Message-Authenticator
+		 *	if it doesn't exist, and it doesn't exist.
+		 */
+		if (found->message_authenticator &&
+		    (request->packet->code == PW_AUTHENTICATION_REQUEST) &&
+		    !pairfind(request->proxy->vps, PW_MESSAGE_AUTHENTICATOR, 0)) {
+			radius_pairmake(request, &request->proxy->vps,
+					"Message-Authenticator", "0x00",
+					T_OP_SET);
+		}
+
+		return found;
 	}
 
 	/*
@@ -1823,19 +2229,19 @@ home_server *home_server_ldb(const char *realmname,
 	 */
 	if (!realm_config->fallback &&
 	    realm_config->wake_all_if_all_dead) {
-		home_server *lb = NULL;
-
 		for (count = 0; count < pool->num_home_servers; count++) {
 			home_server *home = pool->servers[count];
 
+			if (!home) continue;
+
 			if ((home->state == HOME_STATE_IS_DEAD) &&
 			    (home->ping_check == HOME_PING_CHECK_NONE)) {
 				home->state = HOME_STATE_ALIVE;
-				if (!lb) lb = home;
+				if (!found) found = home;
 			}
 		}
 
-		if (lb) return lb;
+		if (found) goto update_and_return;
 	}
 
 	/*
@@ -1870,18 +2276,36 @@ home_server *home_server_ldb(const char *realmname,
 }
 
 
-home_server *home_server_find(fr_ipaddr_t *ipaddr, int port)
+home_server *home_server_find(fr_ipaddr_t *ipaddr, int port, int proto)
 {
 	home_server myhome;
 
 	memset(&myhome, 0, sizeof(myhome));
 	myhome.ipaddr = *ipaddr;
 	myhome.port = port;
+#ifdef WITH_TCP
+	myhome.proto = proto;
+#else
+	myhome.proto = IPPROTO_UDP;
+#endif
 	myhome.server = NULL;	/* we're not called for internal proxying */
 
 	return rbtree_finddata(home_servers_byaddr, &myhome);
 }
 
+#ifdef WITH_COA
+home_server *home_server_byname(const char *name, int type)
+{
+	home_server myhome;
+
+	memset(&myhome, 0, sizeof(myhome));
+	myhome.type = type;
+	myhome.name = name;
+
+	return rbtree_finddata(home_servers_byname, &myhome);
+}
+#endif
+
 #ifdef WITH_STATS
 home_server *home_server_bynumber(int number)
 {
@@ -1894,4 +2318,15 @@ home_server *home_server_bynumber(int number)
 	return rbtree_finddata(home_servers_bynumber, &myhome);
 }
 #endif
+
+home_pool_t *home_pool_byname(const char *name, int type)
+{
+	home_pool_t mypool;
+	
+	memset(&mypool, 0, sizeof(mypool));
+	mypool.name = name;
+	mypool.server_type = type;
+	return rbtree_finddata(home_pools_byname, &mypool);
+}
+
 #endif