X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=src%2Fmain%2Frealms.c;h=37ceb48fb55e737d1b313785f2c3a0ad6d740eff;hb=bca85674a83f94b9cfae0ebdc129bbaf645c8f7d;hp=5c517eb768014fbe1e33288e311abe1cc4031ae6;hpb=92cc8772d5a537b926937719d82d9392d0093991;p=freeradius.git

diff --git a/src/main/realms.c b/src/main/realms.c
index 5c517eb..37ceb48 100644
--- a/src/main/realms.c
+++ b/src/main/realms.c
@@ -32,12 +32,38 @@ RCSID("$Id$")
 #include <ctype.h>
 #include <fcntl.h>
 
+#ifdef HAVE_REGEX_H
+#include <regex.h>
+
+/*
+ *  For POSIX Regular expressions.
+ *  (0) Means no extended regular expressions.
+ *  REG_EXTENDED means use extended regular expressions.
+ */
+#ifndef REG_EXTENDED
+#define REG_EXTENDED (0)
+#endif
+
+#ifndef REG_NOSUB
+#define REG_NOSUB (0)
+#endif
+
+#ifndef REG_ICASE
+#define REG_ICASE (0)
+#endif
+#endif
+
 static rbtree_t *realms_byname = NULL;
 
-static rbtree_t	*home_servers_byaddr = NULL;
-static rbtree_t	*home_servers_byname = NULL;
+#ifdef HAVE_REGEX_H
+typedef struct realm_regex_t {
+	REALM	*realm;
+	struct realm_regex_t *next;
+} realm_regex_t;
 
-static rbtree_t	*home_pools_byname = NULL;
+static realm_regex_t *realms_regex = NULL;
+
+#endif /* HAVE_REGEX_H */
 
 typedef struct realm_config_t {
 	CONF_SECTION	*cs;
@@ -50,6 +76,16 @@ typedef struct realm_config_t {
 
 static realm_config_t *realm_config = NULL;
 
+#ifdef WITH_PROXY
+static rbtree_t	*home_servers_byaddr = NULL;
+static rbtree_t	*home_servers_byname = NULL;
+#ifdef WITH_STATS
+static int home_server_max_number = 0;
+static rbtree_t	*home_servers_bynumber = NULL;
+#endif
+
+static rbtree_t	*home_pools_byname = NULL;
+
 /*
  *  Map the proxy server configuration parameters to variables.
  */
@@ -76,6 +112,7 @@ static const CONF_PARSER proxy_config[] = {
 
 	{ NULL, -1, 0, NULL, NULL }
 };
+#endif
 
 static int realm_name_cmp(const void *one, const void *two)
 {
@@ -86,6 +123,7 @@ static int realm_name_cmp(const void *one, const void *two)
 }
 
 
+#ifdef WITH_PROXY
 static int home_server_name_cmp(const void *one, const void *two)
 {
 	const home_server *a = one;
@@ -102,12 +140,35 @@ static int home_server_addr_cmp(const void *one, const void *two)
 	const home_server *a = one;
 	const home_server *b = two;
 
+	if (a->server && !b->server) return -1;
+	if (!a->server && b->server) return +1;
+
+	if (a->server && b->server) {
+		int rcode = a->type - b->type;
+		if (rcode != 0) return rcode;
+		return strcmp(a->server, b->server);
+	}
+
+#ifdef WITH_TCP
+	if (a->proto < b->proto) return -1;
+	if (a->proto > b->proto) return +1;
+#endif
+
 	if (a->port < b->port) return -1;
 	if (a->port > b->port) return +1;
 
 	return fr_ipaddr_cmp(&a->ipaddr, &b->ipaddr);
 }
 
+#ifdef WITH_STATS
+static int home_server_number_cmp(const void *one, const void *two)
+{
+	const home_server *a = one;
+	const home_server *b = two;
+
+	return (a->number - b->number);
+}
+#endif
 
 static int home_pool_name_cmp(const void *one, const void *two)
 {
@@ -121,6 +182,36 @@ static int home_pool_name_cmp(const void *one, const void *two)
 }
 
 
+static size_t xlat_cs(CONF_SECTION *cs, char *fmt, char *out, size_t outlen)
+
+{
+	const char *value = NULL;
+
+	/*
+	 *	Instance name
+	 */
+	if (strcmp(fmt, "instance") == 0) {
+		value = cf_section_name2(cs);
+		if (!value) {
+			*out = '\0';
+			return 0;
+		}
+	} else {
+		CONF_PAIR *cp;
+
+		cp = cf_pair_find(cs, fmt);
+		if (!cp || !(value = cf_pair_value(cp))) {
+			*out = '\0';
+			return 0;
+		}
+	}
+
+	strlcpy(out, value, outlen);
+
+	return strlen(out);
+}
+
+
 /*
  *	Xlat for %{home_server:foo}
  */
@@ -128,9 +219,6 @@ static size_t xlat_home_server(UNUSED void *instance, REQUEST *request,
 			       char *fmt, char *out, size_t outlen,
 			       UNUSED RADIUS_ESCAPE_STRING func)
 {
-	const char *value = NULL;
-	CONF_PAIR *cp;
-
 	if (!fmt || !out || (outlen < 1)) return 0;
 
 	if (!request || !request->home_server) {
@@ -138,15 +226,7 @@ static size_t xlat_home_server(UNUSED void *instance, REQUEST *request,
 		return 0;
 	}
 
-	cp = cf_pair_find(request->home_server->cs, fmt);
-	if (!cp || !(value = cf_pair_value(cp))) {
-		*out = '\0';
-		return 0;
-	}
-	
-	strlcpy(out, value, outlen);
-
-	return strlen(out);
+	return xlat_cs(request->home_server->cs, fmt, out, outlen);
 }
 
 
@@ -157,9 +237,6 @@ static size_t xlat_server_pool(UNUSED void *instance, REQUEST *request,
 			       char *fmt, char *out, size_t outlen,
 			       UNUSED RADIUS_ESCAPE_STRING func)
 {
-	const char *value = NULL;
-	CONF_PAIR *cp;
-
 	if (!fmt || !out || (outlen < 1)) return 0;
 
 	if (!request || !request->home_pool) {
@@ -167,20 +244,18 @@ static size_t xlat_server_pool(UNUSED void *instance, REQUEST *request,
 		return 0;
 	}
 
-	cp = cf_pair_find(request->home_pool->cs, fmt);
-	if (!cp || !(value = cf_pair_value(cp))) {
-		*out = '\0';
-		return 0;
-	}
-	
-	strlcpy(out, value, outlen);
-
-	return strlen(out);
+	return xlat_cs(request->home_pool->cs, fmt, out, outlen);
 }
-
+#endif
 
 void realms_free(void)
 {
+#ifdef WITH_PROXY
+#ifdef WITH_STATS
+	rbtree_free(home_servers_bynumber);
+	home_servers_bynumber = NULL;
+#endif
+
 	rbtree_free(home_servers_byname);
 	home_servers_byname = NULL;
 
@@ -189,22 +264,63 @@ void realms_free(void)
 
 	rbtree_free(home_pools_byname);
 	home_pools_byname = NULL;
+#endif
 
 	rbtree_free(realms_byname);
 	realms_byname = NULL;
+
+#ifdef HAVE_REGEX_H
+	if (realms_regex) {
+		realm_regex_t *this, *next;
+
+		for (this = realms_regex; this != NULL; this = next) {
+			next = this->next;
+			free(this->realm);
+			free(this);
+		}
+		realms_regex = NULL;
+	}
+#endif
+
+	free(realm_config);
+	realm_config = NULL;
 }
 
 
+#ifdef WITH_PROXY
+static CONF_PARSER limit_config[] = {
+	{ "max_connections", PW_TYPE_INTEGER,
+	  offsetof(home_server, max_connections), NULL,   "16" },
+
+	{ "max_requests", PW_TYPE_INTEGER,
+	  offsetof(home_server,max_requests), NULL,   "0" },
+
+	{ "lifetime", PW_TYPE_INTEGER,
+	  offsetof(home_server,lifetime), NULL,   "0" },
+
+	{ "idle_timeout", PW_TYPE_INTEGER,
+	  offsetof(home_server,idle_timeout), NULL,   "0" },
+
+	{ NULL, -1, 0, NULL, NULL }		/* end the list */
+};
+
 static struct in_addr hs_ip4addr;
 static struct in6_addr hs_ip6addr;
+static char *hs_srcipaddr = NULL;
 static char *hs_type = NULL;
 static char *hs_check = NULL;
+static char *hs_virtual_server = NULL;
+#ifdef WITH_TCP
+static char *hs_proto = NULL;
+#endif
 
 static CONF_PARSER home_server_config[] = {
 	{ "ipaddr",  PW_TYPE_IPADDR,
 	  0, &hs_ip4addr,  NULL },
 	{ "ipv6addr",  PW_TYPE_IPV6ADDR,
 	  0, &hs_ip6addr, NULL },
+	{ "virtual_server",  PW_TYPE_STRING_PTR,
+	  0, &hs_virtual_server, NULL },
 
 	{ "port", PW_TYPE_INTEGER,
 	  offsetof(home_server,port), NULL,   "0" },
@@ -212,20 +328,32 @@ static CONF_PARSER home_server_config[] = {
 	{ "type",  PW_TYPE_STRING_PTR,
 	  0, &hs_type, NULL },
 
+#ifdef WITH_TCP
+	{ "proto",  PW_TYPE_STRING_PTR,
+	  0, &hs_proto, NULL },
+#endif
+
 	{ "secret",  PW_TYPE_STRING_PTR,
 	  offsetof(home_server,secret), NULL,  NULL},
 
+	{ "src_ipaddr",  PW_TYPE_STRING_PTR,
+	  0, &hs_srcipaddr,  NULL },
+
 	{ "response_window", PW_TYPE_INTEGER,
 	  offsetof(home_server,response_window), NULL,   "30" },
+	{ "no_response_fail", PW_TYPE_BOOLEAN,
+	  offsetof(home_server,no_response_fail), NULL,   NULL },
 	{ "max_outstanding", PW_TYPE_INTEGER,
 	  offsetof(home_server,max_outstanding), NULL,   "65536" },
+	{ "require_message_authenticator",  PW_TYPE_BOOLEAN,
+	  offsetof(home_server, message_authenticator), 0, NULL },
 
 	{ "zombie_period", PW_TYPE_INTEGER,
 	  offsetof(home_server,zombie_period), NULL,   "40" },
 	{ "status_check", PW_TYPE_STRING_PTR,
 	  0, &hs_check,   "none" },
 	{ "ping_check", PW_TYPE_STRING_PTR,
-	  0, &hs_check,   "none" },
+	  0, &hs_check,   NULL },
 
 	{ "ping_interval", PW_TYPE_INTEGER,
 	  offsetof(home_server,ping_interval), NULL,   "30" },
@@ -245,16 +373,41 @@ static CONF_PARSER home_server_config[] = {
 	{ "password",  PW_TYPE_STRING_PTR,
 	  offsetof(home_server,ping_user_password), NULL,  NULL},
 
-	{ NULL, -1, 0, NULL, NULL }		/* end the list */
+#ifdef WITH_STATS
+	{ "historic_average_window", PW_TYPE_INTEGER,
+	  offsetof(home_server,ema.window), NULL,  NULL },
+#endif
+
+#ifdef WITH_COA
+	{ "irt",  PW_TYPE_INTEGER,
+	  offsetof(home_server, coa_irt), 0, Stringify(2) },
+	{ "mrt",  PW_TYPE_INTEGER,
+	  offsetof(home_server, coa_mrt), 0, Stringify(16) },
+	{ "mrc",  PW_TYPE_INTEGER,
+	  offsetof(home_server, coa_mrc), 0, Stringify(5) },
+	{ "mrd",  PW_TYPE_INTEGER,
+	  offsetof(home_server, coa_mrd), 0, Stringify(30) },
+#endif
 
+	{ "limit", PW_TYPE_SUBSECTION, 0, NULL, (const void *) limit_config },
+
+	{ NULL, -1, 0, NULL, NULL }		/* end the list */
 };
 
 
-static int home_server_add(CONF_SECTION *cs, int type)
+static void null_free(UNUSED void *data)
+{
+}
+
+static int home_server_add(realm_config_t *rc, CONF_SECTION *cs, int pool_type)
 {
 	const char *name2;
 	home_server *home;
 	int dual = FALSE;
+	CONF_PAIR *cp;
+
+	free(hs_virtual_server); /* used only for printing during parsing */
+	hs_virtual_server = NULL;
 
 	name2 = cf_section_name1(cs);
 	if (!name2 || (strcasecmp(name2, "home_server") != 0)) {
@@ -276,21 +429,28 @@ static int home_server_add(CONF_SECTION *cs, int type)
 	home->name = name2;
 	home->cs = cs;
 
+        /*
+	 *      For zombie period calculations.  We want to count
+	 *      zombies from the time when the server starts, instead
+	 *      of from 1970.
+	 */
+	home->last_packet = time(NULL);
+
+	/*
+	 *	Authentication servers have a default "no_response_fail = 0".
+	 *	Accounting servers have a default "no_response_fail = 1".
+	 *
+	 *	This is because authentication packets are retried, so
+	 *	they can fail over to another home server.  Accounting
+	 *	packets are not retried, so they cannot fail over, and
+	 *	instead should be rejected immediately.
+	 */
+	home->no_response_fail = 2;
+
 	memset(&hs_ip4addr, 0, sizeof(hs_ip4addr));
 	memset(&hs_ip6addr, 0, sizeof(hs_ip6addr));
-	cf_section_parse(cs, home, home_server_config);
-
-	if (!cf_pair_find(cs, "ipaddr") &&
-	    !cf_pair_find(cs, "ipv6addr")) {
-		cf_log_err(cf_sectiontoitem(cs),
-			   "No IPv4 or IPv6 address defined for home server %s.",
-			   name2);
-		free(home);
-		free(hs_type);
-		hs_type = NULL;
-		free(hs_check);
-		hs_check = NULL;
-		return 0;
+	if (cf_section_parse(cs, home, home_server_config) < 0) {
+		goto error;
 	}
 
 	/*
@@ -304,15 +464,46 @@ static int home_server_add(CONF_SECTION *cs, int type)
 		home->ipaddr.af = AF_INET6;
 		home->ipaddr.ipaddr.ip6addr = hs_ip6addr;
 
+	} else if ((cp = cf_pair_find(cs, "virtual_server")) != NULL) {
+		home->ipaddr.af = AF_UNSPEC;
+		home->server = cf_pair_value(cp);
+		if (!home->server) {
+			cf_log_err(cf_sectiontoitem(cs),
+				   "Invalid value for virtual_server");
+			goto error;
+		}
+
+		if (!cf_section_sub_find_name2(rc->cs, "server", home->server)) {
+		  
+			cf_log_err(cf_sectiontoitem(cs),
+				   "No such server %s", home->server);
+			goto error;
+		}
+
+		/*
+		 *	When CoA is used, the user has to specify the type
+		 *	of the home server, even when they point to
+		 *	virtual servers.
+		 */
+		home->secret = strdup("");
+		goto skip_port;
+
 	} else {
 		cf_log_err(cf_sectiontoitem(cs),
-			   "Internal sanity check failed for home server %s.",
+			   "No ipaddr, ipv6addr, or virtual_server defined for home server \"%s\".",
 			   name2);
+	error:
 		free(home);
 		free(hs_type);
 		hs_type = NULL;
 		free(hs_check);
 		hs_check = NULL;
+		free(hs_srcipaddr);
+		hs_srcipaddr = NULL;
+#ifdef WITH_TCP
+		free(hs_proto);
+		hs_proto = NULL;
+#endif
 		return 0;
 	}
 
@@ -320,77 +511,72 @@ static int home_server_add(CONF_SECTION *cs, int type)
 		cf_log_err(cf_sectiontoitem(cs),
 			   "No port, or invalid port defined for home server %s.",
 			   name2);
-		free(home);
-		free(hs_type);
-		hs_type = NULL;
-		free(hs_check);
-		hs_check = NULL;
-		return 0;
+		goto error;
 	}
 
 	if (0) {
 		cf_log_err(cf_sectiontoitem(cs),
 			   "Fatal error!  Home server %s is ourselves!",
 			   name2);
-		free(home);
-		free(hs_type);
-		hs_type = NULL;
-		free(hs_check);
-		hs_check = NULL;
-		return 0;
+		goto error;
+	}
+
+	if (!home->secret) {
+		cf_log_err(cf_sectiontoitem(cs),
+			   "No shared secret defined for home server %s.",
+			   name2);
+		goto error;
 	}
 
 	/*
 	 *	Use a reasonable default.
 	 */
+ skip_port:
 	if (!hs_type) hs_type = strdup("auth+acct");
 
 	if (strcasecmp(hs_type, "auth") == 0) {
 		home->type = HOME_TYPE_AUTH;
-		if (type != home->type) {
+		if (home->no_response_fail == 2) home->no_response_fail = 0;
+		if (pool_type != home->type) {
+		mismatch:
 			cf_log_err(cf_sectiontoitem(cs),
-				   "Server pool of \"acct\" servers cannot include home server %s of type \"auth\"",
-				   name2);
-			free(home);
-			return 0;
+				   "Home server %s of unexpected type \"%s\"",
+				   name2, hs_type);
+			goto error;
 		}
 
 	} else if (strcasecmp(hs_type, "acct") == 0) {
 		home->type = HOME_TYPE_ACCT;
-		if (type != home->type) {
-			cf_log_err(cf_sectiontoitem(cs),
-				   "Server pool of \"auth\" servers cannot include home server %s of type \"acct\"",
-				   name2);
-			free(home);
-			return 0;
-		}
+		if (home->no_response_fail == 2) home->no_response_fail = 1;
+		if (pool_type != home->type) goto mismatch;
 
 	} else if (strcasecmp(hs_type, "auth+acct") == 0) {
 		home->type = HOME_TYPE_AUTH;
 		dual = TRUE;
 
+#ifdef WITH_COA
+	} else if (strcasecmp(hs_type, "coa") == 0) {
+		home->type = HOME_TYPE_COA;
+		dual = FALSE;
+
+		if (pool_type != home->type) goto mismatch;
+
+		if (home->server != NULL) {
+			cf_log_err(cf_sectiontoitem(cs),
+				   "Home servers of type \"coa\" cannot point to a virtual server");
+			goto error;
+		}
+#endif
+
 	} else {
 		cf_log_err(cf_sectiontoitem(cs),
 			   "Invalid type \"%s\" for home server %s.",
 			   hs_type, name2);
-		free(home);
-		free(hs_type);
-		hs_type = NULL;
-		free(hs_check);
-		hs_check = NULL;
-		return 0;
+		goto error;
 	}
 	free(hs_type);
 	hs_type = NULL;
 
-	if (!home->secret) {
-		cf_log_err(cf_sectiontoitem(cs),
-			   "No shared secret defined for home server %s.",
-			   name2);
-		free(home);
-		return 0;
-	}
-
 	if (!hs_check || (strcasecmp(hs_check, "none") == 0)) {
 		home->ping_check = HOME_PING_CHECK_NONE;
 
@@ -404,10 +590,7 @@ static int home_server_add(CONF_SECTION *cs, int type)
 		cf_log_err(cf_sectiontoitem(cs),
 			   "Invalid ping_check \"%s\" for home server %s.",
 			   hs_check, name2);
-		free(home);
-		free(hs_check);
-		hs_check = NULL;
-		return 0;
+		goto error;
 	}
 	free(hs_check);
 	hs_check = NULL;
@@ -416,42 +599,99 @@ static int home_server_add(CONF_SECTION *cs, int type)
 	    (home->ping_check != HOME_PING_CHECK_STATUS_SERVER)) {
 		if (!home->ping_user_name) {
 			cf_log_err(cf_sectiontoitem(cs), "You must supply a user name to enable ping checks");
-			free(home);
-			return 0;
+			goto error;
 		}
 
 		if ((home->type == HOME_TYPE_AUTH) &&
 		    !home->ping_user_password) {
 			cf_log_err(cf_sectiontoitem(cs), "You must supply a password to enable ping checks");
-			free(home);
-			return 0;
+			goto error;
 		}
 	}
 
-	if (rbtree_finddata(home_servers_byaddr, home)) {
-		DEBUG2("Ignoring duplicate home server %s.", name2);
-		return 1;
+	home->proto = IPPROTO_UDP;
+#ifdef WITH_TCP
+	if (hs_proto) {
+		if (strcmp(hs_proto, "udp") == 0) {
+			free(hs_proto);
+			hs_proto = NULL;
+			
+		} else if (strcmp(hs_proto, "tcp") == 0) {
+			free(hs_proto);
+			hs_proto = NULL;
+			home->proto = IPPROTO_TCP;
+			
+		} else {
+			cf_log_err(cf_sectiontoitem(cs),
+				   "Unknown proto \"%s\".", hs_proto);
+			goto error;
+		}
+	}
+#endif
+
+	if (!home->server &&
+	    rbtree_finddata(home_servers_byaddr, home)) {
+		cf_log_err(cf_sectiontoitem(cs), "Duplicate home server");
+		goto error;
+	}
+
+	/*
+	 *	If the home is a virtual server, don't look up source IP.
+	 */
+	if (!home->server) {
+		rad_assert(home->ipaddr.af != AF_UNSPEC);
+
+		/*
+		 *	Otherwise look up the source IP using the same
+		 *	address family as the destination IP.
+		 */
+		if (hs_srcipaddr) {
+			if (ip_hton(hs_srcipaddr, home->ipaddr.af, &home->src_ipaddr) < 0) {
+				cf_log_err(cf_sectiontoitem(cs), "Failed parsing src_ipaddr");
+				goto error;
+			}
+			
+		} else {
+			/*
+			 *	Source isn't specified: Source is
+			 *	the correct address family, but all zeros.
+			 */
+			home->src_ipaddr.af = home->ipaddr.af;
+		}
 	}
 
+	free(hs_srcipaddr);
+	hs_srcipaddr = NULL;
+
 	if (!rbtree_insert(home_servers_byname, home)) {
 		cf_log_err(cf_sectiontoitem(cs),
-			   "Internal error adding home server %s.",
-			   name2);
-		free(home);
-		return 0;
+			   "Internal error %d adding home server %s.",
+			   __LINE__, name2);
+		goto error;
 	}
 
-	if (!rbtree_insert(home_servers_byaddr, home)) {
+	if (!home->server &&
+	    !rbtree_insert(home_servers_byaddr, home)) {
 		rbtree_deletebydata(home_servers_byname, home);
 		cf_log_err(cf_sectiontoitem(cs),
-			   "Internal error adding home server %s.",
-			   name2);
-		free(home);
-		return 0;
+			   "Internal error %d adding home server %s.",
+			   __LINE__, name2);
+		goto error;
 	}
 
-	if (home->response_window < 5) home->response_window = 5;
-	if (home->response_window > 60) home->response_window = 60;
+#ifdef WITH_STATS
+	home->number = home_server_max_number++;
+	if (!rbtree_insert(home_servers_bynumber, home)) {
+		rbtree_deletebydata(home_servers_byname, home);
+		if (home->ipaddr.af != AF_UNSPEC) {
+			rbtree_deletebydata(home_servers_byname, home);
+		}
+		cf_log_err(cf_sectiontoitem(cs),
+			   "Internal error %d adding home server %s.",
+			   __LINE__, name2);
+		goto error;
+	}
+#endif
 
 	if (home->max_outstanding < 8) home->max_outstanding = 8;
 	if (home->max_outstanding > 65536*16) home->max_outstanding = 65536*16;
@@ -459,7 +699,10 @@ static int home_server_add(CONF_SECTION *cs, int type)
 	if (home->ping_interval < 6) home->ping_interval = 6;
 	if (home->ping_interval > 120) home->ping_interval = 120;
 
-	if (home->zombie_period < 20) home->zombie_period = 20;
+	if (home->response_window < 1) home->response_window = 1;
+	if (home->response_window > 60) home->response_window = 60;
+
+	if (home->zombie_period < 1) home->zombie_period = 1;
 	if (home->zombie_period > 120) home->zombie_period = 120;
 
 	if (home->zombie_period < home->response_window) {
@@ -475,6 +718,36 @@ static int home_server_add(CONF_SECTION *cs, int type)
 	if (home->revive_interval < 60) home->revive_interval = 60;
 	if (home->revive_interval > 3600) home->revive_interval = 3600;
 
+#ifdef WITH_COA
+	if (home->coa_irt < 1) home->coa_irt = 1;
+	if (home->coa_irt > 5) home->coa_irt = 5;
+
+	if (home->coa_mrc < 0) home->coa_mrc = 0;
+	if (home->coa_mrc > 20 ) home->coa_mrc = 20;
+
+	if (home->coa_mrt < 0) home->coa_mrt = 0;
+	if (home->coa_mrt > 30 ) home->coa_mrt = 30;
+
+	if (home->coa_mrd < 5) home->coa_mrd = 5;
+	if (home->coa_mrd > 60 ) home->coa_mrd = 60;
+#endif
+
+	if (home->max_connections > 1024) home->max_connections = 1024;
+
+#ifdef WITH_TCP
+	/*
+	 *	UDP sockets can't be connection limited.
+	 */
+	if (home->proto != IPPROTO_TCP) home->max_connections = 0;
+#endif
+
+	if ((home->idle_timeout > 0) && (home->idle_timeout < 5))
+		home->idle_timeout = 5;
+	if ((home->lifetime > 0) && (home->lifetime < 5))
+		home->lifetime = 5;
+	if ((home->lifetime > 0) && (home->idle_timeout > home->lifetime))
+		home->idle_timeout = 0;
+
 	if (dual) {
 		home_server *home2 = rad_malloc(sizeof(*home2));
 
@@ -485,24 +758,48 @@ static int home_server_add(CONF_SECTION *cs, int type)
 		home2->ping_user_password = NULL;
 		home2->cs = cs;
 
+		if (home->no_response_fail == 2) home->no_response_fail = 0;
+		if (home2->no_response_fail == 2) home2->no_response_fail = 1;
+
 		if (!rbtree_insert(home_servers_byname, home2)) {
 			cf_log_err(cf_sectiontoitem(cs),
-				   "Internal error adding home server %s.",
-				   name2);
+				   "Internal error %d adding home server %s.",
+				   __LINE__, name2);
 			free(home2);
 			return 0;
 		}
 		
-		if (!rbtree_insert(home_servers_byaddr, home2)) {
+		if (!home->server &&
+		    !rbtree_insert(home_servers_byaddr, home2)) {
 			rbtree_deletebydata(home_servers_byname, home2);
 			cf_log_err(cf_sectiontoitem(cs),
-				   "Internal error adding home server %s.",
-				   name2);
+				   "Internal error %d adding home server %s.",
+				   __LINE__, name2);
 			free(home2);
 			return 0;
 		}
+
+#ifdef WITH_STATS
+		home2->number = home_server_max_number++;
+		if (!rbtree_insert(home_servers_bynumber, home2)) {
+			rbtree_deletebydata(home_servers_byname, home2);
+			if (!home2->server) {
+				rbtree_deletebydata(home_servers_byname, home2);
+			}
+			cf_log_err(cf_sectiontoitem(cs),
+				   "Internal error %d adding home server %s.",
+				   __LINE__, name2);
+			free(home2);
+			return 0;
+		}
+#endif
 	}
 
+	/*
+	 *	Mark it as already processed
+	 */
+	cf_data_add(cs, "home_server", null_free, null_free);
+
 	return 1;
 }
 
@@ -527,6 +824,50 @@ static home_pool_t *server_pool_alloc(const char *name, home_pool_type_t type,
 	return pool;
 }
 
+static int pool_check_home_server(realm_config_t *rc, CONF_PAIR *cp,
+				  const char *name, int server_type,
+				  home_server **phome)
+{
+	home_server myhome, *home;
+	CONF_SECTION *server_cs;
+
+	if (!name) {
+		cf_log_err(cf_pairtoitem(cp),
+			   "No value given for home_server.");
+		return 0;
+	}
+
+	myhome.name = name;
+	myhome.type = server_type;
+	home = rbtree_finddata(home_servers_byname, &myhome);
+	if (home) {
+		*phome = home;
+		return 1;
+	}
+	
+	server_cs = cf_section_sub_find_name2(rc->cs, "home_server", name);
+	if (!server_cs) {
+		cf_log_err(cf_pairtoitem(cp),
+			   "Unknown home_server \"%s\".", name);
+		return 0;
+	}
+	
+	if (!home_server_add(rc, server_cs, server_type)) {
+		return 0;
+	}
+	
+	home = rbtree_finddata(home_servers_byname, &myhome);
+	if (!home) {
+		cf_log_err(cf_pairtoitem(cp),
+			   "Internal error %d adding home server \"%s\".",
+			   __LINE__, name);
+		return 0;
+	}
+
+	*phome = home;
+	return 1;
+}
+
 
 static int server_pool_add(realm_config_t *rc,
 			   CONF_SECTION *cs, int server_type, int do_print)
@@ -536,6 +877,7 @@ static int server_pool_add(realm_config_t *rc,
 	const char *value;
 	CONF_PAIR *cp;
 	int num_home_servers;
+	home_server *home;
 
 	name2 = cf_section_name1(cs);
 	if (!name2 || ((strcasecmp(name2, "server_pool") != 0) &&
@@ -546,54 +888,23 @@ static int server_pool_add(realm_config_t *rc,
 	}
 
 	name2 = cf_section_name2(cs);
-	if (!name2) {
-		cf_log_err(cf_sectiontoitem(cs),
-			   "Server pool section is missing a name.");
-		return 0;
-	}
-
-	/*
-	 *	Count the home servers and initalize them.
-	 */
-	num_home_servers = 0;
-	for (cp = cf_pair_find(cs, "home_server");
-	     cp != NULL;
-	     cp = cf_pair_find_next(cs, cp, "home_server")) {
-		home_server myhome, *home;
-		CONF_SECTION *server_cs;
-
-		num_home_servers++;
-
-		value = cf_pair_value(cp);
-		if (!value) {
-			cf_log_err(cf_pairtoitem(cp),
-				   "No value given for home_server.");
-			return 0;;
-		}
-
-		myhome.name = value;
-		myhome.type = server_type;
-		home = rbtree_finddata(home_servers_byname, &myhome);
-		if (home) continue;
-
-		server_cs = cf_section_sub_find_name2(rc->cs,
-						      "home_server",
-						      value);
-		if (!server_cs) {
-			cf_log_err(cf_pairtoitem(cp),
-				   "Unknown home_server \"%s\".",
-				   value);
-			return 0;
-		}
+	if (!name2) {
+		cf_log_err(cf_sectiontoitem(cs),
+			   "Server pool section is missing a name.");
+		return 0;
+	}
 
-		if (!home_server_add(server_cs, server_type)) {
-			return 0;
-		}
+	/*
+	 *	Count the home servers and initalize them.
+	 */
+	num_home_servers = 0;
+	for (cp = cf_pair_find(cs, "home_server");
+	     cp != NULL;
+	     cp = cf_pair_find_next(cs, cp, "home_server")) {
+		num_home_servers++;
 
-		home = rbtree_finddata(home_servers_byname, &myhome);
-		if (!home) {
-			radlog(L_ERR, "Internal sanity check failed %d",
-			       __LINE__);
+		if (!pool_check_home_server(rc, cp, cf_pair_value(cp),
+					    server_type, &home)) {
 			return 0;
 		}
 	}
@@ -609,6 +920,32 @@ static int server_pool_add(realm_config_t *rc,
 				 num_home_servers);
 	pool->cs = cs;
 
+
+	/*
+	 *	Fallback servers must be defined, and must be
+	 *	virtual servers.
+	 */
+	cp = cf_pair_find(cs, "fallback");
+	if (cp) {
+#ifdef WITH_COA
+		if (server_type == HOME_TYPE_COA) {
+			cf_log_err(cf_sectiontoitem(cs), "Home server pools of type \"coa\" cannot have a fallback virtual server.");
+			goto error;
+		}
+#endif
+
+		if (!pool_check_home_server(rc, cp, cf_pair_value(cp),
+					    server_type, &pool->fallback)) {
+			
+			goto error;
+		}
+
+		if (!pool->fallback->server) {
+			cf_log_err(cf_sectiontoitem(cs), "Fallback home_server %s does NOT contain a virtual_server directive.", pool->fallback->name);
+			goto error;
+		}
+	}
+
 	if (do_print) cf_log_info(cs, " home_server_pool %s {", name2);
 
 	cp = cf_pair_find(cs, "type");
@@ -644,8 +981,13 @@ static int server_pool_add(realm_config_t *rc,
 
 	cp = cf_pair_find(cs, "virtual_server");
 	if (cp) {
-		pool->virtual_server = cf_pair_value(cp);
-		if (do_print && pool->virtual_server) {
+		pool->virtual_server = cf_pair_value(cp);		
+		if (!pool->virtual_server) {
+			cf_log_err(cf_pairtoitem(cp), "No value given for virtual_server");
+			goto error;
+		}
+
+		if (do_print) {
 			cf_log_info(cs, "\tvirtual_server = %s", pool->virtual_server);
 		}
 
@@ -662,15 +1004,11 @@ static int server_pool_add(realm_config_t *rc,
 	for (cp = cf_pair_find(cs, "home_server");
 	     cp != NULL;
 	     cp = cf_pair_find_next(cs, cp, "home_server")) {
-		home_server myhome, *home;
+		home_server myhome;
 
 		value = cf_pair_value(cp);
-		if (!value) {
-			cf_log_err(cf_pairtoitem(cp),
-				   "No value given for home_server.");
-			goto error;
-		}
 
+		memset(&myhome, 0, sizeof(&myhome));
 		myhome.name = value;
 		myhome.type = server_type;
 
@@ -689,6 +1027,10 @@ static int server_pool_add(realm_config_t *rc,
 		pool->servers[num_home_servers++] = home;
 	} /* loop over home_server's */
 
+	if (pool->fallback && do_print) {
+		cf_log_info(cs, "\tfallback = %s", pool->fallback->name);
+	}
+
 	if (!rbtree_insert(home_pools_byname, pool)) {
 		rad_assert("Internal sanity check failed");
 		goto error;
@@ -696,6 +1038,8 @@ static int server_pool_add(realm_config_t *rc,
 
 	if (do_print) cf_log_info(cs, " }");
 
+	cf_data_add(cs, "home_server_pool", pool, free);
+
 	rad_assert(pool->server_type != 0);
 
 	return 1;
@@ -705,18 +1049,27 @@ static int server_pool_add(realm_config_t *rc,
 	free(pool);
 	return 0;
 }
-
+#endif
 
 static int old_server_add(realm_config_t *rc, CONF_SECTION *cs,
 			  const char *realm,
 			  const char *name, const char *secret,
 			  home_pool_type_t ldflag, home_pool_t **pool_p,
-			  int type)
+			  int type, const char *server)
 {
+#ifdef WITH_PROXY
 	int i, insert_point, num_home_servers;
 	home_server myhome, *home;
 	home_pool_t mypool, *pool;
 	CONF_SECTION *subcs;
+#else
+	rc = rc;		/* -Wunused */
+	realm = realm;
+	secret = secret;
+	ldflag = ldflag;
+	type = type;
+	server = server;
+#endif
 
 	/*
 	 *	LOCAL realms get sanity checked, and nothing else happens.
@@ -729,6 +1082,10 @@ static int old_server_add(realm_config_t *rc, CONF_SECTION *cs,
 		return 1;
 	}
 
+#ifndef WITH_PROXY
+	return 0;		/* Not proxying.  Can't do non-LOCAL realms */
+
+#else
 	mypool.name = realm;
 	mypool.server_type = type;
 	pool = rbtree_finddata(home_pools_byname, &mypool);
@@ -748,7 +1105,7 @@ static int old_server_add(realm_config_t *rc, CONF_SECTION *cs,
 	myhome.type = type;
 	home = rbtree_finddata(home_servers_byname, &myhome);
 	if (home) {
-		if (strcmp(home->secret, secret) != 0) {
+		if (secret && (strcmp(home->secret, secret) != 0)) {
 			cf_log_err(cf_sectiontoitem(cs), "Inconsistent shared secret for home server \"%s\"", name);
 			return 0;
 		}
@@ -809,6 +1166,7 @@ static int old_server_add(realm_config_t *rc, CONF_SECTION *cs,
 		home->type = type;
 		home->secret = secret;
 		home->cs = cs;
+		home->proto = IPPROTO_UDP;
 
 		p = strchr(name, ':');
 		if (!p) {
@@ -844,13 +1202,19 @@ static int old_server_add(realm_config_t *rc, CONF_SECTION *cs,
 			p = q;
 		}
 
-		if (ip_hton(p, AF_UNSPEC, &home->ipaddr) < 0) {
-			cf_log_err(cf_sectiontoitem(cs),
-				   "Failed looking up hostname %s.",
-				   p);
-			free(home);
-			free(q);
-			return 0;
+		if (!server) {
+			if (ip_hton(p, AF_UNSPEC, &home->ipaddr) < 0) {
+				cf_log_err(cf_sectiontoitem(cs),
+					   "Failed looking up hostname %s.",
+					   p);
+				free(home);
+				free(q);
+				return 0;
+			}
+			home->src_ipaddr.af = home->ipaddr.af;
+		} else {
+			home->ipaddr.af = AF_UNSPEC;
+			home->server = server;
 		}
 		free(q);
 
@@ -873,17 +1237,32 @@ static int old_server_add(realm_config_t *rc, CONF_SECTION *cs,
 		}
 
 		if (!rbtree_insert(home_servers_byname, home)) {
-			cf_log_err(cf_sectiontoitem(cs), "Internal error adding home server %s.", name);
+			cf_log_err(cf_sectiontoitem(cs), "Internal error %d adding home server %s.", __LINE__, name);
 			free(home);
 			return 0;
 		}
 
 		if (!rbtree_insert(home_servers_byaddr, home)) {
 			rbtree_deletebydata(home_servers_byname, home);
-			cf_log_err(cf_sectiontoitem(cs), "Internal error adding home server %s.", name);
+			cf_log_err(cf_sectiontoitem(cs), "Internal error %d adding home server %s.", __LINE__, name);
+			free(home);
+			return 0;
+		}
+
+#ifdef WITH_STATS
+		home->number = home_server_max_number++;
+		if (!rbtree_insert(home_servers_bynumber, home)) {
+			rbtree_deletebydata(home_servers_byname, home);
+			if (home->ipaddr.af != AF_UNSPEC) {
+				rbtree_deletebydata(home_servers_byname, home);
+			}
+			cf_log_err(cf_sectiontoitem(cs),
+				   "Internal error %d adding home server %s.",
+				   __LINE__, name);
 			free(home);
 			return 0;
 		}
+#endif
 	}
 
 	/*
@@ -931,6 +1310,7 @@ static int old_server_add(realm_config_t *rc, CONF_SECTION *cs,
 	*pool_p = pool;
 
 	return 1;
+#endif
 }
 
 static int old_realm_config(realm_config_t *rc, CONF_SECTION *cs, REALM *r)
@@ -991,7 +1371,7 @@ static int old_realm_config(realm_config_t *rc, CONF_SECTION *cs, REALM *r)
 		cf_log_info(cs, "\tauthhost = %s",  host);
 
 		if (!old_server_add(rc, cs, r->name, host, secret, ldflag,
-				    &r->auth_pool, HOME_TYPE_AUTH)) {
+				    &r->auth_pool, HOME_TYPE_AUTH, NULL)) {
 			return 0;
 		}
 	}
@@ -1025,7 +1405,27 @@ static int old_realm_config(realm_config_t *rc, CONF_SECTION *cs, REALM *r)
 		cf_log_info(cs, "\taccthost = %s", host);
 
 		if (!old_server_add(rc, cs, r->name, host, secret, ldflag,
-				    &r->acct_pool, HOME_TYPE_ACCT)) {
+				    &r->acct_pool, HOME_TYPE_ACCT, NULL)) {
+			return 0;
+		}
+	}
+
+	cp = cf_pair_find(cs, "virtual_server");
+	if (cp) {
+		host = cf_pair_value(cp);
+		if (!host) {
+			cf_log_err(cf_pairtoitem(cp), "No value specified for virtual_server");
+			return 0;
+		}
+
+		cf_log_info(cs, "\tvirtual_server = %s", host);
+
+		if (!old_server_add(rc, cs, r->name, host, "", ldflag,
+				    &r->auth_pool, HOME_TYPE_AUTH, host)) {
+			return 0;
+		}
+		if (!old_server_add(rc, cs, r->name, host, "", ldflag,
+				    &r->acct_pool, HOME_TYPE_ACCT, host)) {
 			return 0;
 		}
 	}
@@ -1037,6 +1437,7 @@ static int old_realm_config(realm_config_t *rc, CONF_SECTION *cs, REALM *r)
 }
 
 
+#ifdef WITH_PROXY
 static int add_pool_to_realm(realm_config_t *rc, CONF_SECTION *cs,
 			     const char *name, home_pool_t **dest,
 			     int server_type, int do_print)
@@ -1083,14 +1484,18 @@ static int add_pool_to_realm(realm_config_t *rc, CONF_SECTION *cs,
 
 	return 1;
 }
+#endif
+
 
 static int realm_add(realm_config_t *rc, CONF_SECTION *cs)
 {
 	const char *name2;
 	REALM *r = NULL;
 	CONF_PAIR *cp;
+#ifdef WITH_PROXY
 	home_pool_t *auth_pool, *acct_pool;
 	const char *auth_pool_name, *acct_pool_name;
+#endif
 
 	name2 = cf_section_name1(cs);
 	if (!name2 || (strcasecmp(name2, "realm") != 0)) {
@@ -1104,6 +1509,7 @@ static int realm_add(realm_config_t *rc, CONF_SECTION *cs)
 		return 0;
 	}
 
+#ifdef WITH_PROXY
 	auth_pool = acct_pool = NULL;
 	auth_pool_name = acct_pool_name = NULL;
 
@@ -1162,15 +1568,17 @@ static int realm_add(realm_config_t *rc, CONF_SECTION *cs)
 			return 0;
 		}
 	}
+#endif
 
 	cf_log_info(cs, " realm %s {", name2);
 
+#ifdef WITH_PROXY
 	/*
 	 *	The realm MAY already exist if it's an old-style realm.
 	 *	In that case, merge the old-style realm with this one.
 	 */
-	r = realm_find(name2);
-	if (r) {
+	r = realm_find2(name2);
+	if (r && (strcmp(r->name, name2) == 0)) {
 		if (cf_pair_find(cs, "auth_pool") ||
 		    cf_pair_find(cs, "acct_pool")) {
 			cf_log_err(cf_sectiontoitem(cs), "Duplicate realm \"%s\"", name2);
@@ -1184,15 +1592,41 @@ static int realm_add(realm_config_t *rc, CONF_SECTION *cs)
 		cf_log_info(cs, " } # realm %s", name2);
 		return 1;
 	}
+#endif
+
+#ifdef HAVE_REGEX_H
+	if (name2[0] == '~') {
+		int rcode;
+		regex_t reg;
+		
+		/*
+		 *	Include substring matches.
+		 */
+		rcode = regcomp(&reg, name2 + 1,
+				REG_EXTENDED | REG_NOSUB | REG_ICASE);
+		if (rcode != 0) {
+			char buffer[256];
+
+			regerror(rcode, &reg, buffer, sizeof(buffer));
+
+			cf_log_err(cf_sectiontoitem(cs),
+				   "Invalid regex \"%s\": %s",
+				   name2 + 1, buffer);
+			goto error;
+		}
+		regfree(&reg);
+	}
+#endif
 
 	r = rad_malloc(sizeof(*r));
 	memset(r, 0, sizeof(*r));
 
 	r->name = name2;
+	r->striprealm = 1;
+#ifdef WITH_PROXY
 	r->auth_pool = auth_pool;
 	r->acct_pool = acct_pool;
-	r->striprealm = 1;
-
+	
 	if (auth_pool_name &&
 	    (auth_pool_name == acct_pool_name)) { /* yes, ptr comparison */
 		cf_log_info(cs, "\tpool = %s", auth_pool_name);
@@ -1200,6 +1634,7 @@ static int realm_add(realm_config_t *rc, CONF_SECTION *cs)
 		if (auth_pool_name) cf_log_info(cs, "\tauth_pool = %s", auth_pool_name);
 		if (acct_pool_name) cf_log_info(cs, "\tacct_pool = %s", acct_pool_name);
 	}
+#endif
 
 	cp = cf_pair_find(cs, "nostrip");
 	if (cp && (cf_pair_value(cp) == NULL)) {
@@ -1229,6 +1664,29 @@ static int realm_add(realm_config_t *rc, CONF_SECTION *cs)
 		goto error;
 	}
 
+#ifdef HAVE_REGEX_H
+	/*
+	 *	It's a regex.  Add it to a separate list.
+	 */
+	if (name2[0] == '~') {
+		realm_regex_t *rr, **last;
+
+		rr = rad_malloc(sizeof(*rr));
+		
+		last = &realms_regex;
+		while (*last) last = &((*last)->next);  /* O(N^2)... sue me. */
+
+		r->name = name2;
+		rr->realm = r;
+		rr->next = NULL;
+
+		*last = rr;
+
+		cf_log_info(cs, " }");
+		return 1;
+	}
+#endif
+
 	if (!rbtree_insert(realms_byname, r)) {
 		rad_assert("Internal sanity check failed");
 		goto error;
@@ -1244,6 +1702,61 @@ static int realm_add(realm_config_t *rc, CONF_SECTION *cs)
 	return 0;
 }
 
+#ifdef WITH_COA
+static const FR_NAME_NUMBER home_server_types[] = {
+	{ "auth", HOME_TYPE_AUTH },
+	{ "auth+acct", HOME_TYPE_AUTH },
+	{ "acct", HOME_TYPE_ACCT },
+	{ "coa", HOME_TYPE_COA },
+	{ NULL, 0 }
+};
+
+static int pool_peek_type(CONF_SECTION *config, CONF_SECTION *cs)
+{
+	int home;
+	const char *name, *type;
+	CONF_PAIR *cp;
+	CONF_SECTION *server_cs;
+
+	cp = cf_pair_find(cs, "home_server");
+	if (!cp) {
+		cf_log_err(cf_sectiontoitem(cs), "Pool does not contain a \"home_server\" entry");
+		return HOME_TYPE_INVALID;
+	}
+
+	name = cf_pair_value(cp);
+	if (!name) {
+		cf_log_err(cf_pairtoitem(cp), "home_server entry does not reference a home server");
+		return HOME_TYPE_INVALID;
+	}
+
+	server_cs = cf_section_sub_find_name2(config, "home_server", name);
+	if (!server_cs) {
+		cf_log_err(cf_pairtoitem(cp), "home_server \"%s\" does not exist", name);
+		return HOME_TYPE_INVALID;
+	}
+
+	cp = cf_pair_find(server_cs, "type");
+	if (!cp) {
+		cf_log_err(cf_sectiontoitem(server_cs), "home_server %s does not contain a \"type\" entry", name);
+		return HOME_TYPE_INVALID;
+	}
+
+	type = cf_pair_value(cp);
+	if (!type) {
+		cf_log_err(cf_sectiontoitem(server_cs), "home_server %s contains an empty \"type\" entry", name);
+		return HOME_TYPE_INVALID;
+	}
+
+	home = fr_str2int(home_server_types, type, HOME_TYPE_INVALID);
+	if (home == HOME_TYPE_INVALID) {
+		cf_log_err(cf_sectiontoitem(server_cs), "home_server %s contains an invalid \"type\" entry of value \"%s\"", name, type);
+		return HOME_TYPE_INVALID;
+	}
+
+	return home;		/* 'cause we miss it so much */
+}
+#endif
 
 int realms_init(CONF_SECTION *config)
 {
@@ -1258,6 +1771,7 @@ int realms_init(CONF_SECTION *config)
 		return 0;
 	}
 
+#ifdef WITH_PROXY
 	home_servers_byaddr = rbtree_create(home_server_addr_cmp, free, 0);
 	if (!home_servers_byaddr) {
 		realms_free();
@@ -1270,16 +1784,26 @@ int realms_init(CONF_SECTION *config)
 		return 0;
 	}
 
-	home_pools_byname = rbtree_create(home_pool_name_cmp, free, 0);
+#ifdef WITH_STATS
+	home_servers_bynumber = rbtree_create(home_server_number_cmp, NULL, 0);
+	if (!home_servers_bynumber) {
+		realms_free();
+		return 0;
+	}
+#endif
+
+	home_pools_byname = rbtree_create(home_pool_name_cmp, NULL, 0);
 	if (!home_pools_byname) {
 		realms_free();
 		return 0;
 	}
+#endif
 
 	rc = rad_malloc(sizeof(*rc));
 	memset(rc, 0, sizeof(*rc));
 	rc->cs = config;
 
+#ifdef WITH_PROXY
 	cs = cf_subsection_find_next(config, NULL, "proxy");
 	if (cs) {
 		cf_section_parse(cs, rc, proxy_config);
@@ -1290,6 +1814,7 @@ int realms_init(CONF_SECTION *config)
 		rc->fallback = 0;
 		rc->wake_all_if_all_dead= 0;
 	}
+#endif
 
 	for (cs = cf_subsection_find_next(config, NULL, "realm");
 	     cs != NULL;
@@ -1301,8 +1826,50 @@ int realms_init(CONF_SECTION *config)
 		}
 	}
 
+#ifdef WITH_COA
+	/*
+	 *	CoA pools aren't tied to realms.
+	 */
+	for (cs = cf_subsection_find_next(config, NULL, "home_server_pool");
+	     cs != NULL;
+	     cs = cf_subsection_find_next(config, cs, "home_server_pool")) {
+		int type;
+
+		/*
+		 *	Pool was already loaded.
+		 */
+		if (cf_data_find(cs, "home_server_pool")) continue;
+
+		type = pool_peek_type(config, cs);
+		if (type == HOME_TYPE_INVALID) return 0;
+
+		if (!server_pool_add(rc, cs, type, TRUE)) {
+			return 0;
+		}
+	}
+
+	/*
+	 *	CoA home servers aren't tied to realms.
+	 */
+	for (cs = cf_subsection_find_next(config, NULL, "home_server");
+	     cs != NULL;
+	     cs = cf_subsection_find_next(config, cs, "home_server")) {
+		/*
+		 *	Server was already loaded.
+		 */
+		if (cf_data_find(cs, "home_server")) continue;
+
+		if (!home_server_add(rc, cs, HOME_TYPE_COA)) {
+			return 0;
+		}
+	}
+#endif
+
+
+#ifdef WITH_PROXY
 	xlat_register("home_server", xlat_home_server, NULL);
 	xlat_register("home_server_pool", xlat_server_pool, NULL);
+#endif
 
 	/*
 	 *	Swap pointers atomically.
@@ -1314,6 +1881,39 @@ int realms_init(CONF_SECTION *config)
 	return 1;
 }
 
+/*
+ *	Find a realm where "name" might be the regex.
+ */
+REALM *realm_find2(const char *name)
+{
+	REALM myrealm;
+	REALM *realm;
+	
+	if (!name) name = "NULL";
+
+	myrealm.name = name;
+	realm = rbtree_finddata(realms_byname, &myrealm);
+	if (realm) return realm;
+
+#ifdef HAVE_REGEX_H
+	if (realms_regex) {
+		realm_regex_t *this;
+
+		for (this = realms_regex; this != NULL; this = this->next) {
+			if (strcmp(this->realm->name, name) == 0) {
+				return this->realm;
+			}
+		}
+	}
+#endif
+
+	/*
+	 *	Couldn't find a realm.  Look for DEFAULT.
+	 */
+	myrealm.name = "DEFAULT";
+	return rbtree_finddata(realms_byname, &myrealm);
+}
+
 
 /*
  *	Find a realm in the REALM list.
@@ -1321,24 +1921,56 @@ int realms_init(CONF_SECTION *config)
 REALM *realm_find(const char *name)
 {
 	REALM myrealm;
-
+	REALM *realm;
+	
 	if (!name) name = "NULL";
 
 	myrealm.name = name;
+	realm = rbtree_finddata(realms_byname, &myrealm);
+	if (realm) return realm;
+
+#ifdef HAVE_REGEX_H
+	if (realms_regex) {
+		realm_regex_t *this;
+
+		for (this = realms_regex; this != NULL; this = this->next) {
+			int compare;
+			regex_t reg;
+
+			/*
+			 *	Include substring matches.
+			 */
+			if (regcomp(&reg, this->realm->name + 1,
+				    REG_EXTENDED | REG_NOSUB | REG_ICASE) != 0) {
+				continue;
+			}
+
+			compare = regexec(&reg, name, 0, NULL, 0);
+			regfree(&reg);
+
+			if (compare == 0) return this->realm;
+		}
+	}
+#endif
+
+	/*
+	 *	Couldn't find a realm.  Look for DEFAULT.
+	 */
+	myrealm.name = "DEFAULT";
 	return rbtree_finddata(realms_byname, &myrealm);
 }
 
 
+#ifdef WITH_PROXY
 home_server *home_server_ldb(const char *realmname,
 			     home_pool_t *pool, REQUEST *request)
 {
 	int		start;
 	int		count;
 	home_server	*found = NULL;
+	home_server	*zombie = NULL;
 	VALUE_PAIR	*vp;
 
-	start = 0;
-
 	/*
 	 *	Determine how to pick choose the home server.
 	 */
@@ -1390,7 +2022,7 @@ home_server *home_server_ldb(const char *realmname,
 		break;
 
 	case HOME_POOL_KEYED_BALANCE:
-		if ((vp = pairfind(request->config_items, PW_LOAD_BALANCE_KEY)) != NULL) {
+		if ((vp = pairfind(request->config_items, PW_LOAD_BALANCE_KEY, 0)) != NULL) {
 			hash = fr_hash(vp->vp_strvalue, vp->length);
 			start = hash % pool->num_home_servers;
 			break;
@@ -1398,11 +2030,14 @@ home_server *home_server_ldb(const char *realmname,
 		/* FALL-THROUGH */
 				
 	case HOME_POOL_LOAD_BALANCE:
-		found = pool->servers[0];
+	case HOME_POOL_FAIL_OVER:
+		start = 0;
+		break;
 
-	default:
+	default:		/* this shouldn't happen... */
 		start = 0;
 		break;
+
 	}
 
 	/*
@@ -1415,6 +2050,11 @@ home_server *home_server_ldb(const char *realmname,
 	for (count = 0; count < pool->num_home_servers; count++) {
 		home_server *home = pool->servers[(start + count) % pool->num_home_servers];
 
+		if (!home) continue;
+
+		/*
+		 *	Skip dead home servers.
+		 */
 		if (home->state == HOME_STATE_IS_DEAD) {
 			continue;
 		}
@@ -1426,20 +2066,56 @@ home_server *home_server_ldb(const char *realmname,
 			continue;
 		}
 
+#ifdef WITH_DETAIL
+		/*
+		 *	We read the packet from a detail file, AND it
+		 *	came from this server.  Don't re-proxy it
+		 *	there.
+		 */
+		if ((request->listener->type == RAD_LISTEN_DETAIL) &&
+		    (request->packet->code == PW_ACCOUNTING_REQUEST) &&
+		    (fr_ipaddr_cmp(&home->ipaddr, &request->packet->src_ipaddr) == 0)) {
+			continue;
+		}
+#endif
+
+		/*
+		 *	It's zombie, so we remember the first zombie
+		 *	we find, but we don't mark it as a "live"
+		 *	server.
+		 */
+		if (home->state == HOME_STATE_ZOMBIE) {
+			if (!zombie) zombie = home;
+			continue;
+		}
+
+		/*
+		 *	We've found the first "live" one.  Use that.
+		 */
 		if (pool->type != HOME_POOL_LOAD_BALANCE) {
-			return home;
+			found = home;
+			break;
+		}
+
+		/*
+		 *	Otherwise we're doing some kind of load balancing.
+		 *	If we haven't found one yet, pick this one.
+		 */
+		if (!found) {
+			found = home;
+			continue;
 		}
 
-		DEBUG3("PROXY %s %d\t%s %d",
+		RDEBUG3("PROXY %s %d\t%s %d",
 		       found->name, found->currently_outstanding,
 		       home->name, home->currently_outstanding);
 
 		/*
 		 *	Prefer this server if it's less busy than the
-		 *	one we previously found.
+		 *	one we had previously found.
 		 */
 		if (home->currently_outstanding < found->currently_outstanding) {
-			DEBUG3("Choosing %s: It's less busy than %s",
+			RDEBUG3("PROXY Choosing %s: It's less busy than %s",
 			       home->name, found->name);
 			found = home;
 			continue;
@@ -1450,20 +2126,7 @@ home_server *home_server_ldb(const char *realmname,
 		 *	we found.
 		 */
 		if (home->currently_outstanding > found->currently_outstanding) {
-			DEBUG3("Skipping %s: It's busier than %s",
-			       home->name, found->name);
-			continue;
-		}
-
-		if (home->total_requests_sent < found->total_requests_sent) {
-			DEBUG3("Choosing %s: It's been less busy than %s",
-			       home->name, found->name);
-			found = home;
-			continue;
-		}
-
-		if (home->total_requests_sent > found->total_requests_sent) {
-			DEBUG3("Skipping %s: It's been busier than %s",
+			RDEBUG3("PROXY Skipping %s: It's busier than %s",
 			       home->name, found->name);
 			continue;
 		}
@@ -1475,10 +2138,87 @@ home_server *home_server_ldb(const char *realmname,
 		if (((count + 1) * (fr_rand() & 0xffff)) < (uint32_t) 0x10000) {
 			found = home;
 		}
-
 	} /* loop over the home servers */
 
-	if (found) return found;
+	/*
+	 *	We have no live servers, BUT we have a zombie.  Use
+	 *	the zombie as a last resort.
+	 */
+	if (!found && zombie) {
+		found = zombie;
+		zombie = NULL;
+	}
+
+	/*
+	 *	There's a fallback if they're all dead.
+	 */
+	if (!found && pool->fallback) {
+		found = pool->fallback;
+	}
+
+	if (found) {
+	update_and_return:
+		/*
+		 *	Allocate the proxy packet, only if it wasn't
+		 *	already allocated by a module.  This check is
+		 *	mainly to support the proxying of EAP-TTLS and
+		 *	EAP-PEAP tunneled requests.
+		 *
+		 *	In those cases, the EAP module creates a
+		 *	"fake" request, and recursively passes it
+		 *	through the authentication stage of the
+		 *	server.  The module then checks if the request
+		 *	was supposed to be proxied, and if so, creates
+		 *	a proxy packet from the TUNNELED request, and
+		 *	not from the EAP request outside of the
+		 *	tunnel.
+		 *
+		 *	The proxy then works like normal, except that
+		 *	the response packet is "eaten" by the EAP
+		 *	module, and encapsulated into an EAP packet.
+		 */
+		if (!request->proxy) {
+			if ((request->proxy = rad_alloc(TRUE)) == NULL) {
+				radlog(L_ERR|L_CONS, "no memory");
+				exit(1);
+			}
+			
+			/*
+			 *	Copy the request, then look up name
+			 *	and plain-text password in the copy.
+			 *
+			 *	Note that the User-Name attribute is
+			 *	the *original* as sent over by the
+			 *	client.  The Stripped-User-Name
+			 *	attribute is the one hacked through
+			 *	the 'hints' file.
+			 */
+			request->proxy->vps =  paircopy(request->packet->vps);
+		}
+
+		/*
+		 *	Update the various fields as appropriate.
+		 */
+		request->proxy->src_ipaddr = found->src_ipaddr;
+		request->proxy->src_port = 0;
+		request->proxy->dst_ipaddr = found->ipaddr;
+		request->proxy->dst_port = found->port;
+		request->home_server = found;
+
+		/*
+		 *	We're supposed to add a Message-Authenticator
+		 *	if it doesn't exist, and it doesn't exist.
+		 */
+		if (found->message_authenticator &&
+		    (request->packet->code == PW_AUTHENTICATION_REQUEST) &&
+		    !pairfind(request->proxy->vps, PW_MESSAGE_AUTHENTICATOR, 0)) {
+			radius_pairmake(request, &request->proxy->vps,
+					"Message-Authenticator", "0x00",
+					T_OP_SET);
+		}
+
+		return found;
+	}
 
 	/*
 	 *	No live match found, and no fallback to the "DEFAULT"
@@ -1489,19 +2229,19 @@ home_server *home_server_ldb(const char *realmname,
 	 */
 	if (!realm_config->fallback &&
 	    realm_config->wake_all_if_all_dead) {
-		home_server *lb = NULL;
-
 		for (count = 0; count < pool->num_home_servers; count++) {
 			home_server *home = pool->servers[count];
 
+			if (!home) continue;
+
 			if ((home->state == HOME_STATE_IS_DEAD) &&
 			    (home->ping_check == HOME_PING_CHECK_NONE)) {
 				home->state = HOME_STATE_ALIVE;
-				if (!lb) lb = home;
+				if (!found) found = home;
 			}
 		}
 
-		if (lb) return lb;
+		if (found) goto update_and_return;
 	}
 
 	/*
@@ -1525,7 +2265,7 @@ home_server *home_server_ldb(const char *realmname,
 		}
 		if (!pool) return NULL;
 
-		DEBUG2("  Realm %s has no live home servers.  Falling back to the DEFAULT realm.", realmname);
+		RDEBUG2("PROXY - realm %s has no live home servers.  Falling back to the DEFAULT realm.", realmname);
 		return home_server_ldb(rd->name, pool, request);
 	}
 
@@ -1536,12 +2276,57 @@ home_server *home_server_ldb(const char *realmname,
 }
 
 
-home_server *home_server_find(fr_ipaddr_t *ipaddr, int port)
+home_server *home_server_find(fr_ipaddr_t *ipaddr, int port, int proto)
 {
 	home_server myhome;
 
+	memset(&myhome, 0, sizeof(myhome));
 	myhome.ipaddr = *ipaddr;
 	myhome.port = port;
+#ifdef WITH_TCP
+	myhome.proto = proto;
+#else
+	myhome.proto = IPPROTO_UDP;
+#endif
+	myhome.server = NULL;	/* we're not called for internal proxying */
 
 	return rbtree_finddata(home_servers_byaddr, &myhome);
 }
+
+#ifdef WITH_COA
+home_server *home_server_byname(const char *name, int type)
+{
+	home_server myhome;
+
+	memset(&myhome, 0, sizeof(myhome));
+	myhome.type = type;
+	myhome.name = name;
+
+	return rbtree_finddata(home_servers_byname, &myhome);
+}
+#endif
+
+#ifdef WITH_STATS
+home_server *home_server_bynumber(int number)
+{
+	home_server myhome;
+
+	memset(&myhome, 0, sizeof(myhome));
+	myhome.number = number;
+	myhome.server = NULL;	/* we're not called for internal proxying */
+
+	return rbtree_finddata(home_servers_bynumber, &myhome);
+}
+#endif
+
+home_pool_t *home_pool_byname(const char *name, int type)
+{
+	home_pool_t mypool;
+	
+	memset(&mypool, 0, sizeof(mypool));
+	mypool.name = name;
+	mypool.server_type = type;
+	return rbtree_finddata(home_pools_byname, &mypool);
+}
+
+#endif