src/main/listen.c

   1 /*
   2  * listen.c     Handle socket stuff
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2005,2006  The FreeRADIUS server project
  21  * Copyright 2005  Alan DeKok <aland@ox.org>
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include <freeradius-devel/radiusd.h>
  28 #include <freeradius-devel/modules.h>
  29 #include <freeradius-devel/rad_assert.h>
  30 #include <freeradius-devel/vqp.h>
  31 #include <freeradius-devel/dhcp.h>
  32
  33 #include <freeradius-devel/vmps.h>
  34 #include <freeradius-devel/detail.h>
  35
  36 #ifdef WITH_UDPFROMTO
  37 #include <freeradius-devel/udpfromto.h>
  38 #endif
  39
  40 #ifdef HAVE_SYS_RESOURCE_H
  41 #include <sys/resource.h>
  42 #endif
  43
  44 #ifdef HAVE_NET_IF_H
  45 #include <net/if.h>
  46 #endif
  47
  48 #ifdef HAVE_FCNTL_H
  49 #include <fcntl.h>
  50 #endif
  51
  52
  53 /*
  54  *      We'll use this below.
  55  */
  56 typedef int (*rad_listen_parse_t)(CONF_SECTION *, rad_listen_t *);
  57 typedef void (*rad_listen_free_t)(rad_listen_t *);
  58
  59 typedef struct rad_listen_master_t {
  60         rad_listen_parse_t      parse;
  61         rad_listen_free_t       free;
  62         rad_listen_recv_t       recv;
  63         rad_listen_send_t       send;
  64         rad_listen_print_t      print;
  65         rad_listen_encode_t     encode;
  66         rad_listen_decode_t     decode;
  67 } rad_listen_master_t;
  68
  69 typedef struct listen_socket_t {
  70         /*
  71          *      For normal sockets.
  72          */
  73         fr_ipaddr_t     ipaddr;
  74         int             port;
  75         const char              *interface;
  76         RADCLIENT_LIST  *clients;
  77 } listen_socket_t;
  78
  79 static rad_listen_t *listen_alloc(RAD_LISTEN_TYPE type);
  80
  81 /*
  82  *      Find a per-socket client.
  83  */
  84 RADCLIENT *client_listener_find(const rad_listen_t *listener,
  85                                 const fr_ipaddr_t *ipaddr, int src_port)
  86 {
  87 #ifdef WITH_DYNAMIC_CLIENTS
  88         int rcode;
  89         REQUEST *request;
  90         RADCLIENT *created;
  91 #endif
  92         time_t now;
  93         RADCLIENT *client;
  94         RADCLIENT_LIST *clients;
  95
  96         rad_assert(listener != NULL);
  97         rad_assert(ipaddr != NULL);
  98
  99         clients = ((listen_socket_t *)listener->data)->clients;
 100
 101         /*
 102          *      This HAS to have been initialized previously.
 103          */
 104         rad_assert(clients != NULL);
 105
 106         client = client_find(clients, ipaddr);
 107         if (!client) {
 108                 static time_t last_printed = 0;
 109                 char name[256], buffer[128];
 110
 111 #ifdef WITH_DYNAMIC_CLIENTS
 112         unknown:                /* used only for dynamic clients */
 113 #endif
 114
 115                 /*
 116                  *      DoS attack quenching, but only in debug mode.
 117                  *      If they're running in debug mode, show them
 118                  *      every packet.
 119                  */
 120                 if (debug_flag == 0) {
 121                         now = time(NULL);
 122                         if (last_printed == now) return NULL;
 123
 124                         last_printed = now;
 125                 }
 126
 127                 listener->print(listener, name, sizeof(name));
 128
 129                 radlog(L_ERR, "Ignoring request to %s from unknown client %s port %d",
 130                        name, inet_ntop(ipaddr->af, &ipaddr->ipaddr,
 131                                        buffer, sizeof(buffer)),
 132                        src_port);
 133                 return NULL;
 134         }
 135
 136 #ifndef WITH_DYNAMIC_CLIENTS
 137         return client;          /* return the found client. */
 138 #else
 139
 140         /*
 141          *      No server defined, and it's not dynamic.  Return it.
 142          */
 143         if (!client->client_server && !client->dynamic) return client;
 144
 145         now = time(NULL);
 146
 147         /*
 148          *      It's a dynamically generated client, check it.
 149          */
 150         if (client->dynamic && (src_port != 0)) {
 151                 /*
 152                  *      Lives forever.  Return it.
 153                  */
 154                 if (client->lifetime == 0) return client;
 155
 156                 /*
 157                  *      Rate-limit the deletion of known clients.
 158                  *      This makes them last a little longer, but
 159                  *      prevents the server from melting down if (say)
 160                  *      10k clients all expire at once.
 161                  */
 162                 if (now == client->last_new_client) return client;
 163
 164                 /*
 165                  *      It's not dead yet.  Return it.
 166                  */
 167                 if ((client->created + client->lifetime) > now) return client;
 168
 169                 /*
 170                  *      This really puts them onto a queue for later
 171                  *      deletion.
 172                  */
 173                 client_delete(clients, client);
 174
 175                 /*
 176                  *      Go find the enclosing network again.
 177                  */
 178                 client = client_find(clients, ipaddr);
 179
 180                 /*
 181                  *      WTF?
 182                  */
 183                 if (!client) goto unknown;
 184                 if (!client->client_server) goto unknown;
 185
 186                 /*
 187                  *      At this point, 'client' is the enclosing
 188                  *      network that configures where dynamic clients
 189                  *      can be defined.
 190                  */
 191                 rad_assert(client->dynamic == 0);
 192
 193         } else if (!client->dynamic && client->rate_limit) {
 194                 /*
 195                  *      The IP is unknown, so we've found an enclosing
 196                  *      network.  Enable DoS protection.  We only
 197                  *      allow one new client per second.  Known
 198                  *      clients aren't subject to this restriction.
 199                  */
 200                 if (now == client->last_new_client) goto unknown;
 201         }
 202
 203         client->last_new_client = now;
 204
 205         request = request_alloc();
 206         if (!request) goto unknown;
 207
 208         request->listener = listener;
 209         request->client = client;
 210         request->packet = rad_recv(listener->fd, 0x02); /* MSG_PEEK */
 211         if (!request->packet) {                         /* badly formed, etc */
 212                 request_free(&request);
 213                 goto unknown;
 214         }
 215         request->reply = rad_alloc_reply(request->packet);
 216         if (!request->reply) {
 217                 request_free(&request);
 218                 goto unknown;
 219         }
 220         request->packet->timestamp = request->timestamp;
 221         request->number = 0;
 222         request->priority = listener->type;
 223         request->server = client->client_server;
 224         request->root = &mainconfig;
 225
 226         /*
 227          *      Run a fake request through the given virtual server.
 228          *      Look for FreeRADIUS-Client-IP-Address
 229          *               FreeRADIUS-Client-Secret
 230          *              ...
 231          *
 232          *      and create the RADCLIENT structure from that.
 233          */
 234         DEBUG("server %s {", request->server);
 235
 236         rcode = module_authorize(0, request);
 237
 238         DEBUG("} # server %s", request->server);
 239
 240         if (rcode != RLM_MODULE_OK) {
 241                 request_free(&request);
 242                 goto unknown;
 243         }
 244
 245         /*
 246          *      If the client was updated by rlm_dynamic_clients,
 247          *      don't create the client from attribute-value pairs.
 248          */
 249         if (request->client == client) {
 250                 created = client_create(clients, request);
 251         } else {
 252                 created = request->client;
 253
 254                 /*
 255                  *      This frees the client if it isn't valid.
 256                  */
 257                 if (!client_validate(clients, client, created)) goto unknown;
 258         }
 259         request_free(&request);
 260
 261         if (!created) goto unknown;
 262
 263         return created;
 264 #endif
 265 }
 266
 267 static int listen_bind(rad_listen_t *this);
 268
 269
 270 /*
 271  *      Process and reply to a server-status request.
 272  *      Like rad_authenticate and rad_accounting this should
 273  *      live in it's own file but it's so small we don't bother.
 274  */
 275 static int rad_status_server(REQUEST *request)
 276 {
 277         int rcode = RLM_MODULE_OK;
 278         DICT_VALUE *dval;
 279
 280         switch (request->listener->type) {
 281 #ifdef WITH_STATS
 282         case RAD_LISTEN_NONE:
 283 #endif
 284         case RAD_LISTEN_AUTH:
 285                 dval = dict_valbyname(PW_AUTZ_TYPE, "Status-Server");
 286                 if (dval) {
 287                         rcode = module_authorize(dval->value, request);
 288                 } else {
 289                         rcode = RLM_MODULE_OK;
 290                 }
 291
 292                 switch (rcode) {
 293                 case RLM_MODULE_OK:
 294                 case RLM_MODULE_UPDATED:
 295                         request->reply->code = PW_AUTHENTICATION_ACK;
 296                         break;
 297
 298                 case RLM_MODULE_FAIL:
 299                 case RLM_MODULE_HANDLED:
 300                         request->reply->code = 0; /* don't reply */
 301                         break;
 302
 303                 default:
 304                 case RLM_MODULE_REJECT:
 305                         request->reply->code = PW_AUTHENTICATION_REJECT;
 306                         break;
 307                 }
 308                 break;
 309
 310 #ifdef WITH_ACCOUNTING
 311         case RAD_LISTEN_ACCT:
 312                 dval = dict_valbyname(PW_ACCT_TYPE, "Status-Server");
 313                 if (dval) {
 314                         rcode = module_accounting(dval->value, request);
 315                 } else {
 316                         rcode = RLM_MODULE_OK;
 317                 }
 318
 319                 switch (rcode) {
 320                 case RLM_MODULE_OK:
 321                 case RLM_MODULE_UPDATED:
 322                         request->reply->code = PW_ACCOUNTING_RESPONSE;
 323                         break;
 324
 325                 default:
 326                         request->reply->code = 0; /* don't reply */
 327                         break;
 328                 }
 329                 break;
 330 #endif
 331
 332 #ifdef WITH_COA
 333                 /*
 334                  *      This is a vendor extension.  Suggested by Glen
 335                  *      Zorn in IETF 72, and rejected by the rest of
 336                  *      the WG.  We like it, so it goes in here.
 337                  */
 338         case RAD_LISTEN_COA:
 339                 dval = dict_valbyname(PW_RECV_COA_TYPE, "Status-Server");
 340                 if (dval) {
 341                         rcode = module_recv_coa(dval->value, request);
 342                 } else {
 343                         rcode = RLM_MODULE_OK;
 344                 }
 345
 346                 switch (rcode) {
 347                 case RLM_MODULE_OK:
 348                 case RLM_MODULE_UPDATED:
 349                         request->reply->code = PW_COA_ACK;
 350                         break;
 351
 352                 default:
 353                         request->reply->code = 0; /* don't reply */
 354                         break;
 355                 }
 356                 break;
 357 #endif
 358
 359         default:
 360                 return 0;
 361         }
 362
 363 #ifdef WITH_STATS
 364         /*
 365          *      Full statistics are available only on a statistics
 366          *      socket.
 367          */
 368         if (request->listener->type == RAD_LISTEN_NONE) {
 369                 request_stats_reply(request);
 370         }
 371 #endif
 372
 373         return 0;
 374 }
 375
 376
 377 static int socket_print(const rad_listen_t *this, char *buffer, size_t bufsize)
 378 {
 379         size_t len;
 380         listen_socket_t *sock = this->data;
 381         const char *name;
 382
 383         switch (this->type) {
 384 #ifdef WITH_STATS
 385         case RAD_LISTEN_NONE:   /* what a hack... */
 386                 name = "status";
 387                 break;
 388 #endif
 389
 390         case RAD_LISTEN_AUTH:
 391                 name = "authentication";
 392                 break;
 393
 394 #ifdef WITH_ACCOUNTING
 395         case RAD_LISTEN_ACCT:
 396                 name = "accounting";
 397                 break;
 398 #endif
 399
 400 #ifdef WITH_PROXY
 401         case RAD_LISTEN_PROXY:
 402                 name = "proxy";
 403                 break;
 404 #endif
 405
 406 #ifdef WITH_VMPS
 407         case RAD_LISTEN_VQP:
 408                 name = "vmps";
 409                 break;
 410 #endif
 411
 412 #ifdef WITH_DHCP
 413         case RAD_LISTEN_DHCP:
 414                 name = "dhcp";
 415                 break;
 416 #endif
 417
 418 #ifdef WITH_COA
 419         case RAD_LISTEN_COA:
 420                 name = "coa";
 421                 break;
 422 #endif
 423
 424         default:
 425                 name = "??";
 426                 break;
 427         }
 428
 429 #define FORWARD len = strlen(buffer); if (len >= (bufsize + 1)) return 0;buffer += len;bufsize -= len
 430 #define ADDSTRING(_x) strlcpy(buffer, _x, bufsize);FORWARD
 431
 432         ADDSTRING(name);
 433
 434         if (sock->interface) {
 435                 ADDSTRING(" interface ");
 436                 ADDSTRING(sock->interface);
 437         }
 438
 439         ADDSTRING(" address ");
 440
 441         if ((sock->ipaddr.af == AF_INET) &&
 442             (sock->ipaddr.ipaddr.ip4addr.s_addr == htonl(INADDR_ANY))) {
 443                 strlcpy(buffer, "*", bufsize);
 444         } else {
 445                 ip_ntoh(&sock->ipaddr, buffer, bufsize);
 446         }
 447         FORWARD;
 448
 449         ADDSTRING(" port ");
 450         snprintf(buffer, bufsize, "%d", sock->port);
 451         FORWARD;
 452
 453         if (this->server) {
 454                 ADDSTRING(" as server ");
 455                 ADDSTRING(this->server);
 456         }
 457
 458 #undef ADDSTRING
 459 #undef FORWARD
 460
 461         return 1;
 462 }
 463
 464 extern int check_config;        /* radiusd.c */
 465
 466
 467 /*
 468  *      Parse an authentication or accounting socket.
 469  */
 470 static int common_socket_parse(CONF_SECTION *cs, rad_listen_t *this)
 471 {
 472         int             rcode;
 473         int             listen_port;
 474         fr_ipaddr_t     ipaddr;
 475         listen_socket_t *sock = this->data;
 476         char            *section_name = NULL;
 477         CONF_SECTION    *client_cs, *parentcs;
 478
 479         /*
 480          *      Try IPv4 first
 481          */
 482         ipaddr.ipaddr.ip4addr.s_addr = htonl(INADDR_NONE);
 483         rcode = cf_item_parse(cs, "ipaddr", PW_TYPE_IPADDR,
 484                               &ipaddr.ipaddr.ip4addr, NULL);
 485         if (rcode < 0) return -1;
 486
 487         if (rcode == 0) { /* successfully parsed IPv4 */
 488                 ipaddr.af = AF_INET;
 489
 490         } else {        /* maybe IPv6? */
 491                 rcode = cf_item_parse(cs, "ipv6addr", PW_TYPE_IPV6ADDR,
 492                                       &ipaddr.ipaddr.ip6addr, NULL);
 493                 if (rcode < 0) return -1;
 494
 495                 if (rcode == 1) {
 496                         cf_log_err(cf_sectiontoitem(cs),
 497                                    "No address specified in listen section");
 498                         return -1;
 499                 }
 500                 ipaddr.af = AF_INET6;
 501         }
 502
 503         rcode = cf_item_parse(cs, "port", PW_TYPE_INTEGER,
 504                               &listen_port, "0");
 505         if (rcode < 0) return -1;
 506
 507         if ((listen_port < 0) || (listen_port > 65535)) {
 508                         cf_log_err(cf_sectiontoitem(cs),
 509                                    "Invalid value for \"port\"");
 510                         return -1;
 511         }
 512
 513         sock->ipaddr = ipaddr;
 514         sock->port = listen_port;
 515
 516         if (check_config) {
 517                 if (home_server_find(&sock->ipaddr, sock->port)) {
 518                                 char buffer[128];
 519
 520                                 DEBUG("ERROR: We have been asked to listen on %s port %d, which is also listed as a home server.  This can create a proxy loop.",
 521                                       ip_ntoh(&sock->ipaddr, buffer, sizeof(buffer)),
 522                                       sock->port);
 523                                 return -1;
 524                 }
 525
 526                 return 0;       /* don't do anything */
 527         }
 528
 529         /*
 530          *      If we can bind to interfaces, do so,
 531          *      else don't.
 532          */
 533         if (cf_pair_find(cs, "interface")) {
 534                 const char *value;
 535                 CONF_PAIR *cp = cf_pair_find(cs, "interface");
 536
 537                 rad_assert(cp != NULL);
 538                 value = cf_pair_value(cp);
 539                 if (!value) {
 540                         cf_log_err(cf_sectiontoitem(cs),
 541                                    "No interface name given");
 542                         return -1;
 543                 }
 544                 sock->interface = value;
 545         }
 546
 547         /*
 548          *      And bind it to the port.
 549          */
 550         if (listen_bind(this) < 0) {
 551                 char buffer[128];
 552                 cf_log_err(cf_sectiontoitem(cs),
 553                            "Error binding to port for %s port %d",
 554                            ip_ntoh(&sock->ipaddr, buffer, sizeof(buffer)),
 555                            sock->port);
 556                 return -1;
 557         }
 558
 559 #ifdef WITH_PROXY
 560         /*
 561          *      Proxy sockets don't have clients.
 562          */
 563         if (this->type == RAD_LISTEN_PROXY) return 0;
 564 #endif
 565
 566         /*
 567          *      The more specific configurations are preferred to more
 568          *      generic ones.
 569          */
 570         client_cs = NULL;
 571         parentcs = cf_top_section(cs);
 572         rcode = cf_item_parse(cs, "clients", PW_TYPE_STRING_PTR,
 573                               &section_name, NULL);
 574         if (rcode < 0) return -1; /* bad string */
 575         if (rcode == 0) {
 576                 /*
 577                  *      Explicit list given: use it.
 578                  */
 579                 client_cs = cf_section_sub_find_name2(parentcs,
 580                                                       "clients",
 581                                                       section_name);
 582                 if (!client_cs) {
 583                         client_cs = cf_section_find(section_name);
 584                 }
 585                 if (!client_cs) {
 586                         cf_log_err(cf_sectiontoitem(cs),
 587                                    "Failed to find clients %s {...}",
 588                                    section_name);
 589                         free(section_name);
 590                         return -1;
 591                 }
 592                 free(section_name);
 593         } /* else there was no "clients = " entry. */
 594
 595         if (!client_cs) {
 596                 CONF_SECTION *server_cs;
 597
 598                 server_cs = cf_section_sub_find_name2(parentcs,
 599                                                       "server",
 600                                                       this->server);
 601                 /*
 602                  *      Found a "server foo" section.  If there are clients
 603                  *      in it, use them.
 604                  */
 605                 if (server_cs &&
 606                     (cf_section_sub_find(server_cs, "client") != NULL)) {
 607                         client_cs = server_cs;
 608                 }
 609         }
 610
 611         /*
 612          *      Still nothing.  Look for global clients.
 613          */
 614         if (!client_cs) client_cs = parentcs;
 615
 616         sock->clients = clients_parse_section(client_cs);
 617         if (!sock->clients) {
 618                 cf_log_err(cf_sectiontoitem(cs),
 619                            "Failed to load clients for this listen section");
 620                 return -1;
 621         }
 622
 623         return 0;
 624 }
 625
 626 /*
 627  *      Send an authentication response packet
 628  */
 629 static int auth_socket_send(rad_listen_t *listener, REQUEST *request)
 630 {
 631         rad_assert(request->listener == listener);
 632         rad_assert(listener->send == auth_socket_send);
 633
 634         return rad_send(request->reply, request->packet,
 635                         request->client->secret);
 636 }
 637
 638
 639 #ifdef WITH_ACCOUNTING
 640 /*
 641  *      Send an accounting response packet (or not)
 642  */
 643 static int acct_socket_send(rad_listen_t *listener, REQUEST *request)
 644 {
 645         rad_assert(request->listener == listener);
 646         rad_assert(listener->send == acct_socket_send);
 647
 648         /*
 649          *      Accounting reject's are silently dropped.
 650          *
 651          *      We do it here to avoid polluting the rest of the
 652          *      code with this knowledge
 653          */
 654         if (request->reply->code == 0) return 0;
 655
 656         return rad_send(request->reply, request->packet,
 657                         request->client->secret);
 658 }
 659 #endif
 660
 661 #ifdef WITH_PROXY
 662 /*
 663  *      Send a packet to a home server.
 664  *
 665  *      FIXME: have different code for proxy auth & acct!
 666  */
 667 static int proxy_socket_send(rad_listen_t *listener, REQUEST *request)
 668 {
 669         listen_socket_t *sock = listener->data;
 670
 671         rad_assert(request->proxy_listener == listener);
 672         rad_assert(listener->send == proxy_socket_send);
 673
 674         request->proxy->src_ipaddr = sock->ipaddr;
 675         request->proxy->src_port = sock->port;
 676
 677         return rad_send(request->proxy, request->packet,
 678                         request->home_server->secret);
 679 }
 680 #endif
 681
 682 #ifdef WITH_STATS
 683 /*
 684  *      Check if an incoming request is "ok"
 685  *
 686  *      It takes packets, not requests.  It sees if the packet looks
 687  *      OK.  If so, it does a number of sanity checks on it.
 688   */
 689 static int stats_socket_recv(rad_listen_t *listener,
 690                             RAD_REQUEST_FUNP *pfun, REQUEST **prequest)
 691 {
 692         ssize_t         rcode;
 693         int             code, src_port;
 694         RADIUS_PACKET   *packet;
 695         RADCLIENT       *client;
 696         fr_ipaddr_t     src_ipaddr;
 697
 698         rcode = rad_recv_header(listener->fd, &src_ipaddr, &src_port, &code);
 699         if (rcode < 0) return 0;
 700
 701         RAD_STATS_TYPE_INC(listener, total_requests);
 702
 703         if (rcode < 20) {       /* AUTH_HDR_LEN */
 704                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 705                 return 0;
 706         }
 707
 708         if ((client = client_listener_find(listener,
 709                                            &src_ipaddr, src_port)) == NULL) {
 710                 rad_recv_discard(listener->fd);
 711                 RAD_STATS_TYPE_INC(listener, total_invalid_requests);
 712                 return 0;
 713         }
 714
 715         /*
 716          *      We only understand Status-Server on this socket.
 717          */
 718         if (code != PW_STATUS_SERVER) {
 719                 DEBUG("Ignoring packet code %d sent to Status-Server port",
 720                       code);
 721                 rad_recv_discard(listener->fd);
 722                 RAD_STATS_TYPE_INC(listener, total_unknown_types);
 723                 RAD_STATS_CLIENT_INC(listener, client, total_unknown_types);
 724                 return 0;
 725         }
 726
 727         /*
 728          *      Now that we've sanity checked everything, receive the
 729          *      packet.
 730          */
 731         packet = rad_recv(listener->fd, 1); /* require message authenticator */
 732         if (!packet) {
 733                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 734                 DEBUG("%s", fr_strerror());
 735                 return 0;
 736         }
 737
 738         if (!received_request(listener, packet, prequest, client)) {
 739                 RAD_STATS_TYPE_INC(listener, total_packets_dropped);
 740                 RAD_STATS_CLIENT_INC(listener, client, total_packets_dropped);
 741                 rad_free(&packet);
 742                 return 0;
 743         }
 744
 745         *pfun = rad_status_server;
 746         return 1;
 747 }
 748 #endif
 749
 750
 751 /*
 752  *      Check if an incoming request is "ok"
 753  *
 754  *      It takes packets, not requests.  It sees if the packet looks
 755  *      OK.  If so, it does a number of sanity checks on it.
 756   */
 757 static int auth_socket_recv(rad_listen_t *listener,
 758                             RAD_REQUEST_FUNP *pfun, REQUEST **prequest)
 759 {
 760         ssize_t         rcode;
 761         int             code, src_port;
 762         RADIUS_PACKET   *packet;
 763         RAD_REQUEST_FUNP fun = NULL;
 764         RADCLIENT       *client;
 765         fr_ipaddr_t     src_ipaddr;
 766
 767         rcode = rad_recv_header(listener->fd, &src_ipaddr, &src_port, &code);
 768         if (rcode < 0) return 0;
 769
 770         RAD_STATS_TYPE_INC(listener, total_requests);
 771
 772         if (rcode < 20) {       /* AUTH_HDR_LEN */
 773                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 774                 return 0;
 775         }
 776
 777         if ((client = client_listener_find(listener,
 778                                            &src_ipaddr, src_port)) == NULL) {
 779                 rad_recv_discard(listener->fd);
 780                 RAD_STATS_TYPE_INC(listener, total_invalid_requests);
 781                 return 0;
 782         }
 783
 784         /*
 785          *      Some sanity checks, based on the packet code.
 786          */
 787         switch(code) {
 788         case PW_AUTHENTICATION_REQUEST:
 789                 RAD_STATS_CLIENT_INC(listener, client, total_requests);
 790                 fun = rad_authenticate;
 791                 break;
 792
 793         case PW_STATUS_SERVER:
 794                 if (!mainconfig.status_server) {
 795                         rad_recv_discard(listener->fd);
 796                         RAD_STATS_TYPE_INC(listener, total_packets_dropped);
 797                         RAD_STATS_CLIENT_INC(listener, client, total_packets_dropped);
 798                         DEBUG("WARNING: Ignoring Status-Server request due to security configuration");
 799                         return 0;
 800                 }
 801                 fun = rad_status_server;
 802                 break;
 803
 804         default:
 805                 rad_recv_discard(listener->fd);
 806                 RAD_STATS_INC(radius_auth_stats.total_unknown_types);
 807                 RAD_STATS_CLIENT_INC(listener, client, total_unknown_types);
 808
 809                 DEBUG("Invalid packet code %d sent to authentication port from client %s port %d : IGNORED",
 810                       code, client->shortname, src_port);
 811                 return 0;
 812                 break;
 813         } /* switch over packet types */
 814
 815         /*
 816          *      Now that we've sanity checked everything, receive the
 817          *      packet.
 818          */
 819         packet = rad_recv(listener->fd, client->message_authenticator);
 820         if (!packet) {
 821                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 822                 DEBUG("%s", fr_strerror());
 823                 return 0;
 824         }
 825
 826         if (!received_request(listener, packet, prequest, client)) {
 827                 RAD_STATS_TYPE_INC(listener, total_packets_dropped);
 828                 RAD_STATS_CLIENT_INC(listener, client, total_packets_dropped);
 829                 rad_free(&packet);
 830                 return 0;
 831         }
 832
 833         *pfun = fun;
 834         return 1;
 835 }
 836
 837
 838 #ifdef WITH_ACCOUNTING
 839 /*
 840  *      Receive packets from an accounting socket
 841  */
 842 static int acct_socket_recv(rad_listen_t *listener,
 843                             RAD_REQUEST_FUNP *pfun, REQUEST **prequest)
 844 {
 845         ssize_t         rcode;
 846         int             code, src_port;
 847         RADIUS_PACKET   *packet;
 848         RAD_REQUEST_FUNP fun = NULL;
 849         RADCLIENT       *client;
 850         fr_ipaddr_t     src_ipaddr;
 851
 852         rcode = rad_recv_header(listener->fd, &src_ipaddr, &src_port, &code);
 853         if (rcode < 0) return 0;
 854
 855         RAD_STATS_TYPE_INC(listener, total_requests);
 856
 857         if (rcode < 20) {       /* AUTH_HDR_LEN */
 858                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 859                 return 0;
 860         }
 861
 862         if ((client = client_listener_find(listener,
 863                                            &src_ipaddr, src_port)) == NULL) {
 864                 rad_recv_discard(listener->fd);
 865                 RAD_STATS_TYPE_INC(listener, total_invalid_requests);
 866                 return 0;
 867         }
 868
 869         /*
 870          *      Some sanity checks, based on the packet code.
 871          */
 872         switch(code) {
 873         case PW_ACCOUNTING_REQUEST:
 874                 RAD_STATS_CLIENT_INC(listener, client, total_requests);
 875                 fun = rad_accounting;
 876                 break;
 877
 878         case PW_STATUS_SERVER:
 879                 if (!mainconfig.status_server) {
 880                         rad_recv_discard(listener->fd);
 881                         RAD_STATS_TYPE_INC(listener, total_packets_dropped);
 882                         RAD_STATS_CLIENT_INC(listener, client, total_unknown_types);
 883
 884                         DEBUG("WARNING: Ignoring Status-Server request due to security configuration");
 885                         return 0;
 886                 }
 887                 fun = rad_status_server;
 888                 break;
 889
 890         default:
 891                 rad_recv_discard(listener->fd);
 892                 RAD_STATS_TYPE_INC(listener, total_unknown_types);
 893                 RAD_STATS_CLIENT_INC(listener, client, total_unknown_types);
 894
 895                 DEBUG("Invalid packet code %d sent to a accounting port from client %s port %d : IGNORED",
 896                       code, client->shortname, src_port);
 897                 return 0;
 898         } /* switch over packet types */
 899
 900         /*
 901          *      Now that we've sanity checked everything, receive the
 902          *      packet.
 903          */
 904         packet = rad_recv(listener->fd, 0);
 905         if (!packet) {
 906                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
 907                 radlog(L_ERR, "%s", fr_strerror());
 908                 return 0;
 909         }
 910
 911         /*
 912          *      There can be no duplicate accounting packets.
 913          */
 914         if (!received_request(listener, packet, prequest, client)) {
 915                 RAD_STATS_TYPE_INC(listener, total_packets_dropped);
 916                 RAD_STATS_CLIENT_INC(listener, client, total_packets_dropped);
 917                 rad_free(&packet);
 918                 return 0;
 919         }
 920
 921         *pfun = fun;
 922         return 1;
 923 }
 924 #endif
 925
 926
 927 #ifdef WITH_COA
 928 /*
 929  *      For now, all CoA requests are *only* originated, and not
 930  *      proxied.  So all of the necessary work is done in the
 931  *      post-proxy section, which is automatically handled by event.c.
 932  *      As a result, we don't have to do anything here.
 933  */
 934 static int rad_coa_reply(REQUEST *request)
 935 {
 936         VALUE_PAIR *s1, *s2;
 937
 938         /*
 939          *      Inform the user about RFC requirements.
 940          */
 941         s1 = pairfind(request->proxy->vps, PW_STATE);
 942         if (s1) {
 943                 s2 = pairfind(request->proxy_reply->vps, PW_STATE);
 944
 945                 if (!s2) {
 946                         DEBUG("WARNING: Client was sent State in CoA, and did not respond with State.");
 947
 948                 } else if ((s1->length != s2->length) ||
 949                            (memcmp(s1->vp_octets, s2->vp_octets,
 950                                    s1->length) != 0)) {
 951                         DEBUG("WARNING: Client was sent State in CoA, and did not respond with the same State.");
 952                 }
 953         }
 954
 955         return RLM_MODULE_OK;
 956 }
 957
 958 /*
 959  *      Receive a CoA packet.
 960  */
 961 static int rad_coa_recv(REQUEST *request)
 962 {
 963         int rcode = RLM_MODULE_OK;
 964         int ack, nak;
 965         VALUE_PAIR *vp;
 966
 967         /*
 968          *      Get the correct response
 969          */
 970         switch (request->packet->code) {
 971         case PW_COA_REQUEST:
 972                 ack = PW_COA_ACK;
 973                 nak = PW_COA_NAK;
 974                 break;
 975
 976         case PW_DISCONNECT_REQUEST:
 977                 ack = PW_DISCONNECT_ACK;
 978                 nak = PW_DISCONNECT_NAK;
 979                 break;
 980
 981         default:                /* shouldn't happen */
 982                 return RLM_MODULE_FAIL;
 983         }
 984
 985 #ifdef WITH_PROXY
 986 #define WAS_PROXIED (request->proxy)
 987 #else
 988 #define WAS_PROXIED (0)
 989 #endif
 990
 991         if (!WAS_PROXIED) {
 992                 /*
 993                  *      RFC 5176 Section 3.3.  If we have a CoA-Request
 994                  *      with Service-Type = Authorize-Only, it MUST
 995                  *      have a State attribute in it.
 996                  */
 997                 vp = pairfind(request->packet->vps, PW_SERVICE_TYPE);
 998                 if (request->packet->code == PW_COA_REQUEST) {
 999                         if (vp && (vp->vp_integer == 17)) {
1000                                 vp = pairfind(request->packet->vps, PW_STATE);
1001                                 if (!vp || (vp->length == 0)) {
1002                                         RDEBUG("ERROR: CoA-Request with Service-Type = Authorize-Only MUST contain a State attribute");
1003                                         request->reply->code = PW_COA_NAK;
1004                                         return RLM_MODULE_FAIL;
1005                                 }
1006                         }
1007                 } else if (vp) {
1008                         /*
1009                          *      RFC 5176, Section 3.2.
1010                          */
1011                         RDEBUG("ERROR: Disconnect-Request MUST NOT contain a Service-Type attribute");
1012                         request->reply->code = PW_DISCONNECT_NAK;
1013                         return RLM_MODULE_FAIL;
1014                 }
1015
1016                 rcode = module_recv_coa(0, request);
1017                 switch (rcode) {
1018                 case RLM_MODULE_FAIL:
1019                 case RLM_MODULE_INVALID:
1020                 case RLM_MODULE_REJECT:
1021                 case RLM_MODULE_USERLOCK:
1022                 default:
1023                         request->reply->code = nak;
1024                         break;
1025
1026                 case RLM_MODULE_HANDLED:
1027                         return rcode;
1028
1029                 case RLM_MODULE_NOOP:
1030                 case RLM_MODULE_NOTFOUND:
1031                 case RLM_MODULE_OK:
1032                 case RLM_MODULE_UPDATED:
1033                         request->reply->code = ack;
1034                         break;
1035                 }
1036         } else {
1037                 /*
1038                  *      Start the reply code with the proxy reply
1039                  *      code.
1040                  */
1041                 request->reply->code = request->proxy_reply->code;
1042         }
1043
1044         /*
1045          *      Copy State from the request to the reply.
1046          *      See RFC 5176 Section 3.3.
1047          */
1048         vp = paircopy2(request->packet->vps, PW_STATE);
1049         if (vp) pairadd(&request->reply->vps, vp);
1050
1051         /*
1052          *      We may want to over-ride the reply.
1053          */
1054         rcode = module_send_coa(0, request);
1055         switch (rcode) {
1056                 /*
1057                  *      We need to send CoA-NAK back if Service-Type
1058                  *      is Authorize-Only.  Rely on the user's policy
1059                  *      to do that.  We're not a real NAS, so this
1060                  *      restriction doesn't (ahem) apply to us.
1061                  */
1062                 case RLM_MODULE_FAIL:
1063                 case RLM_MODULE_INVALID:
1064                 case RLM_MODULE_REJECT:
1065                 case RLM_MODULE_USERLOCK:
1066                 default:
1067                         /*
1068                          *      Over-ride an ACK with a NAK
1069                          */
1070                         request->reply->code = nak;
1071                         break;
1072
1073                 case RLM_MODULE_HANDLED:
1074                         return rcode;
1075
1076                 case RLM_MODULE_NOOP:
1077                 case RLM_MODULE_NOTFOUND:
1078                 case RLM_MODULE_OK:
1079                 case RLM_MODULE_UPDATED:
1080                         /*
1081                          *      Do NOT over-ride a previously set value.
1082                          *      Otherwise an "ok" here will re-write a
1083                          *      NAK to an ACK.
1084                          */
1085                         if (request->reply->code == 0) {
1086                                 request->reply->code = ack;
1087                         }
1088                         break;
1089
1090         }
1091
1092         return RLM_MODULE_OK;
1093 }
1094
1095
1096 /*
1097  *      Check if an incoming request is "ok"
1098  *
1099  *      It takes packets, not requests.  It sees if the packet looks
1100  *      OK.  If so, it does a number of sanity checks on it.
1101   */
1102 static int coa_socket_recv(rad_listen_t *listener,
1103                             RAD_REQUEST_FUNP *pfun, REQUEST **prequest)
1104 {
1105         ssize_t         rcode;
1106         int             code, src_port;
1107         RADIUS_PACKET   *packet;
1108         RAD_REQUEST_FUNP fun = NULL;
1109         char            buffer[128];
1110         RADCLIENT       *client;
1111         fr_ipaddr_t     src_ipaddr;
1112
1113         rcode = rad_recv_header(listener->fd, &src_ipaddr, &src_port, &code);
1114         if (rcode < 0) return 0;
1115
1116         RAD_STATS_TYPE_INC(listener, total_requests);
1117
1118         if (rcode < 20) {       /* AUTH_HDR_LEN */
1119                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
1120                 return 0;
1121         }
1122
1123         if ((client = client_listener_find(listener,
1124                                            &src_ipaddr, src_port)) == NULL) {
1125                 rad_recv_discard(listener->fd);
1126                 RAD_STATS_TYPE_INC(listener, total_invalid_requests);
1127
1128                 if (debug_flag > 0) {
1129                         char name[1024];
1130
1131                         listener->print(listener, name, sizeof(name));
1132
1133                         /*
1134                          *      This is debugging rather than logging, so that
1135                          *      DoS attacks don't affect us.
1136                          */
1137                         DEBUG("Ignoring request to %s from unknown client %s port %d",
1138                               name,
1139                               inet_ntop(src_ipaddr.af, &src_ipaddr.ipaddr,
1140                                         buffer, sizeof(buffer)), src_port);
1141                 }
1142
1143                 return 0;
1144         }
1145
1146         /*
1147          *      Some sanity checks, based on the packet code.
1148          */
1149         switch(code) {
1150         case PW_COA_REQUEST:
1151         case PW_DISCONNECT_REQUEST:
1152                 fun = rad_coa_recv;
1153                 break;
1154
1155         default:
1156                 rad_recv_discard(listener->fd);
1157                 DEBUG("Invalid packet code %d sent to coa port from client %s port %d : IGNORED",
1158                       code, client->shortname, src_port);
1159                 return 0;
1160                 break;
1161         } /* switch over packet types */
1162
1163         /*
1164          *      Now that we've sanity checked everything, receive the
1165          *      packet.
1166          */
1167         packet = rad_recv(listener->fd, client->message_authenticator);
1168         if (!packet) {
1169                 RAD_STATS_TYPE_INC(listener, total_malformed_requests);
1170                 DEBUG("%s", fr_strerror());
1171                 return 0;
1172         }
1173
1174         if (!received_request(listener, packet, prequest, client)) {
1175                 rad_free(&packet);
1176                 return 0;
1177         }
1178
1179         *pfun = fun;
1180         return 1;
1181 }
1182 #endif
1183
1184 #ifdef WITH_PROXY
1185 /*
1186  *      Recieve packets from a proxy socket.
1187  */
1188 static int proxy_socket_recv(rad_listen_t *listener,
1189                               RAD_REQUEST_FUNP *pfun, REQUEST **prequest)
1190 {
1191         REQUEST         *request;
1192         RADIUS_PACKET   *packet;
1193         RAD_REQUEST_FUNP fun = NULL;
1194         char            buffer[128];
1195
1196         packet = rad_recv(listener->fd, 0);
1197         if (!packet) {
1198                 radlog(L_ERR, "%s", fr_strerror());
1199                 return 0;
1200         }
1201
1202         /*
1203          *      FIXME: Client MIB updates?
1204          */
1205         switch(packet->code) {
1206         case PW_AUTHENTICATION_ACK:
1207         case PW_ACCESS_CHALLENGE:
1208         case PW_AUTHENTICATION_REJECT:
1209                 fun = rad_authenticate;
1210                 break;
1211
1212 #ifdef WITH_ACCOUNTING
1213         case PW_ACCOUNTING_RESPONSE:
1214                 fun = rad_accounting;
1215                 break;
1216 #endif
1217
1218 #ifdef WITH_COA
1219         case PW_DISCONNECT_ACK:
1220         case PW_DISCONNECT_NAK:
1221         case PW_COA_ACK:
1222         case PW_COA_NAK:
1223                 fun = rad_coa_reply;
1224                 break;
1225 #endif
1226
1227         default:
1228                 /*
1229                  *      FIXME: Update MIB for packet types?
1230                  */
1231                 radlog(L_ERR, "Invalid packet code %d sent to a proxy port "
1232                        "from home server %s port %d - ID %d : IGNORED",
1233                        packet->code,
1234                        ip_ntoh(&packet->src_ipaddr, buffer, sizeof(buffer)),
1235                        packet->src_port, packet->id);
1236                 rad_free(&packet);
1237                 return 0;
1238         }
1239
1240         request = received_proxy_response(packet);
1241         if (!request) {
1242                 rad_free(&packet);
1243                 return 0;
1244         }
1245
1246 #ifdef WITH_COA
1247         /*
1248          *      Distinguish proxied CoA requests from ones we
1249          *      originate.
1250          */
1251         if ((fun == rad_coa_reply) &&
1252             (request->packet->code == request->proxy->code)) {
1253                 fun = rad_coa_recv;
1254         }
1255 #endif
1256
1257         rad_assert(fun != NULL);
1258         *pfun = fun;
1259         *prequest = request;
1260
1261         return 1;
1262 }
1263 #endif
1264
1265
1266 static int client_socket_encode(UNUSED rad_listen_t *listener, REQUEST *request)
1267 {
1268         if (!request->reply->code) return 0;
1269
1270         rad_encode(request->reply, request->packet,
1271                    request->client->secret);
1272         rad_sign(request->reply, request->packet,
1273                  request->client->secret);
1274
1275         return 0;
1276 }
1277
1278
1279 static int client_socket_decode(UNUSED rad_listen_t *listener, REQUEST *request)
1280 {
1281         if (rad_verify(request->packet, NULL,
1282                        request->client->secret) < 0) {
1283                 return -1;
1284         }
1285
1286         return rad_decode(request->packet, NULL,
1287                           request->client->secret);
1288 }
1289
1290 #ifdef WITH_PROXY
1291 static int proxy_socket_encode(UNUSED rad_listen_t *listener, REQUEST *request)
1292 {
1293         rad_encode(request->proxy, NULL, request->home_server->secret);
1294         rad_sign(request->proxy, NULL, request->home_server->secret);
1295
1296         return 0;
1297 }
1298
1299
1300 static int proxy_socket_decode(UNUSED rad_listen_t *listener, REQUEST *request)
1301 {
1302         /*
1303          *      rad_verify is run in event.c, received_proxy_response()
1304          */
1305
1306         return rad_decode(request->proxy_reply, request->proxy,
1307                            request->home_server->secret);
1308 }
1309 #endif
1310
1311 #include "dhcpd.c"
1312
1313 #include "command.c"
1314
1315 static const rad_listen_master_t master_listen[RAD_LISTEN_MAX] = {
1316 #ifdef WITH_STATS
1317         { common_socket_parse, NULL,
1318           stats_socket_recv, auth_socket_send,
1319           socket_print, client_socket_encode, client_socket_decode },
1320 #else
1321         /*
1322          *      This always gets defined.
1323          */
1324         { NULL, NULL, NULL, NULL, NULL, NULL, NULL},    /* RAD_LISTEN_NONE */
1325 #endif
1326
1327 #ifdef WITH_PROXY
1328         /* proxying */
1329         { common_socket_parse, NULL,
1330           proxy_socket_recv, proxy_socket_send,
1331           socket_print, proxy_socket_encode, proxy_socket_decode },
1332 #endif
1333
1334         /* authentication */
1335         { common_socket_parse, NULL,
1336           auth_socket_recv, auth_socket_send,
1337           socket_print, client_socket_encode, client_socket_decode },
1338
1339 #ifdef WITH_ACCOUNTING
1340         /* accounting */
1341         { common_socket_parse, NULL,
1342           acct_socket_recv, acct_socket_send,
1343           socket_print, client_socket_encode, client_socket_decode},
1344 #endif
1345
1346 #ifdef WITH_DETAIL
1347         /* detail */
1348         { detail_parse, detail_free,
1349           detail_recv, detail_send,
1350           detail_print, detail_encode, detail_decode },
1351 #endif
1352
1353 #ifdef WITH_VMPS
1354         /* vlan query protocol */
1355         { common_socket_parse, NULL,
1356           vqp_socket_recv, vqp_socket_send,
1357           socket_print, vqp_socket_encode, vqp_socket_decode },
1358 #endif
1359
1360 #ifdef WITH_DHCP
1361         /* dhcp query protocol */
1362         { dhcp_socket_parse, NULL,
1363           dhcp_socket_recv, dhcp_socket_send,
1364           socket_print, dhcp_socket_encode, dhcp_socket_decode },
1365 #endif
1366
1367 #ifdef WITH_COMMAND_SOCKET
1368         /* TCP command socket */
1369         { command_socket_parse, command_socket_free,
1370           command_domain_accept, command_domain_send,
1371           command_socket_print, command_socket_encode, command_socket_decode },
1372 #endif
1373
1374 #ifdef WITH_COA
1375         /* Change of Authorization */
1376         { common_socket_parse, NULL,
1377           coa_socket_recv, auth_socket_send, /* CoA packets are same as auth */
1378           socket_print, client_socket_encode, client_socket_decode },
1379 #endif
1380
1381 };
1382
1383
1384
1385 /*
1386  *      Binds a listener to a socket.
1387  */
1388 static int listen_bind(rad_listen_t *this)
1389 {
1390         int rcode;
1391         struct sockaddr_storage salocal;
1392         socklen_t       salen;
1393         listen_socket_t *sock = this->data;
1394
1395         /*
1396          *      If the port is zero, then it means the appropriate
1397          *      thing from /etc/services.
1398          */
1399         if (sock->port == 0) {
1400                 struct servent  *svp;
1401
1402                 switch (this->type) {
1403                 case RAD_LISTEN_AUTH:
1404                         svp = getservbyname ("radius", "udp");
1405                         if (svp != NULL) {
1406                                 sock->port = ntohs(svp->s_port);
1407                         } else {
1408                                 sock->port = PW_AUTH_UDP_PORT;
1409                         }
1410                         break;
1411
1412 #ifdef WITH_ACCOUNTING
1413                 case RAD_LISTEN_ACCT:
1414                         svp = getservbyname ("radacct", "udp");
1415                         if (svp != NULL) {
1416                                 sock->port = ntohs(svp->s_port);
1417                         } else {
1418                                 sock->port = PW_ACCT_UDP_PORT;
1419                         }
1420                         break;
1421 #endif
1422
1423 #ifdef WITH_PROXY
1424                 case RAD_LISTEN_PROXY:
1425                         sock->port = 0;
1426                         break;
1427 #endif
1428
1429 #ifdef WITH_VMPS
1430                 case RAD_LISTEN_VQP:
1431                         sock->port = 1589;
1432                         break;
1433 #endif
1434
1435 #ifdef WITH_COA
1436                 case RAD_LISTEN_COA:
1437                         svp = getservbyname ("radius-dynauth", "udp");
1438                         if (svp != NULL) {
1439                                 sock->port = ntohs(svp->s_port);
1440                         } else {
1441                                 sock->port = PW_COA_UDP_PORT;
1442                         }
1443                         break;
1444 #endif
1445
1446                 default:
1447                         DEBUG("WARNING: Internal sanity check failed in binding to socket.  Ignoring problem.");
1448                         return -1;
1449                 }
1450         }
1451
1452         /*
1453          *      Copy fr_socket() here, as we may need to bind to a device.
1454          */
1455         this->fd = socket(sock->ipaddr.af, SOCK_DGRAM, 0);
1456         if (this->fd < 0) {
1457                 radlog(L_ERR, "Failed opening socket: %s", strerror(errno));
1458                 return -1;
1459         }
1460
1461         /*
1462          *      Bind to a device BEFORE touching IP addresses.
1463          */
1464         if (sock->interface) {
1465 #ifdef SO_BINDTODEVICE
1466                 struct ifreq ifreq;
1467                 strcpy(ifreq.ifr_name, sock->interface);
1468
1469                 fr_suid_up();
1470                 rcode = setsockopt(this->fd, SOL_SOCKET, SO_BINDTODEVICE,
1471                                    (char *)&ifreq, sizeof(ifreq));
1472                 fr_suid_down();
1473                 if (rcode < 0) {
1474                         close(this->fd);
1475                         radlog(L_ERR, "Failed binding to interface %s: %s",
1476                                sock->interface, strerror(errno));
1477                         return -1;
1478                 } /* else it worked. */
1479 #else
1480 #ifdef HAVE_STRUCT_SOCKADDR_IN6
1481 #ifdef HAVE_NET_IF_H
1482                 /*
1483                  *      Odds are that any system supporting "bind to
1484                  *      device" also supports IPv6, so this next bit
1485                  *      isn't necessary.  But it's here for
1486                  *      completeness.
1487                  *
1488                  *      If we're doing IPv6, and the scope hasn't yet
1489                  *      been defined, set the scope to the scope of
1490                  *      the interface.
1491                  */
1492                 if (sock->ipaddr.af == AF_INET6) {
1493                         if (sock->ipaddr.scope == 0) {
1494                                 sock->ipaddr.scope = if_nametoindex(sock->interface);
1495                                 if (sock->ipaddr.scope == 0) {
1496                                         close(this->fd);
1497                                         radlog(L_ERR, "Failed finding interface %s: %s",
1498                                                sock->interface, strerror(errno));
1499                                         return -1;
1500                                 }
1501                         } /* else scope was defined: we're OK. */
1502                 } else
1503 #endif
1504 #endif
1505                                 /*
1506                                  *      IPv4: no link local addresses,
1507                                  *      and no bind to device.
1508                                  */
1509                 {
1510                         close(this->fd);
1511                         radlog(L_ERR, "Failed binding to interface %s: \"bind to device\" is unsupported", sock->interface);
1512                         return -1;
1513                 }
1514 #endif
1515         }
1516
1517 #ifdef WITH_UDPFROMTO
1518         /*
1519          *      Initialize udpfromto for all sockets.
1520          */
1521         if (udpfromto_init(this->fd) != 0) {
1522                 close(this->fd);
1523                 return -1;
1524         }
1525 #endif
1526
1527         /*
1528          *      Set up sockaddr stuff.
1529          */
1530         if (!fr_ipaddr2sockaddr(&sock->ipaddr, sock->port, &salocal, &salen)) {
1531                 close(this->fd);
1532                 return -1;
1533         }
1534
1535 #ifdef HAVE_STRUCT_SOCKADDR_IN6
1536         if (sock->ipaddr.af == AF_INET6) {
1537                 /*
1538                  *      Listening on '::' does NOT get you IPv4 to
1539                  *      IPv6 mapping.  You've got to listen on an IPv4
1540                  *      address, too.  This makes the rest of the server
1541                  *      design a little simpler.
1542                  */
1543 #ifdef IPV6_V6ONLY
1544
1545                 if (IN6_IS_ADDR_UNSPECIFIED(&sock->ipaddr.ipaddr.ip6addr)) {
1546                         int on = 1;
1547
1548                         setsockopt(this->fd, IPPROTO_IPV6, IPV6_V6ONLY,
1549                                    (char *)&on, sizeof(on));
1550                 }
1551 #endif /* IPV6_V6ONLY */
1552         }
1553 #endif /* HAVE_STRUCT_SOCKADDR_IN6 */
1554
1555
1556         if (sock->ipaddr.af == AF_INET) {
1557                 UNUSED int flag;
1558
1559 #if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
1560                 /*
1561                  *      Disable PMTU discovery.  On Linux, this
1562                  *      also makes sure that the "don't fragment"
1563                  *      flag is zero.
1564                  */
1565                 flag = IP_PMTUDISC_DONT;
1566                 setsockopt(this->fd, IPPROTO_IP, IP_MTU_DISCOVER,
1567                            &flag, sizeof(flag));
1568 #endif
1569
1570 #if defined(IP_DONTFRAG)
1571                 /*
1572                  *      Ensure that the "don't fragment" flag is zero.
1573                  */
1574                 flag = 0;
1575                 setsockopt(this->fd, IPPROTO_IP, IP_DONTFRAG,
1576                            &flag, sizeof(flag));
1577 #endif
1578         }
1579
1580         /*
1581          *      May be binding to priviledged ports.
1582          */
1583         fr_suid_up();
1584         rcode = bind(this->fd, (struct sockaddr *) &salocal, salen);
1585         fr_suid_down();
1586         if (rcode < 0) {
1587                 char buffer[256];
1588                 close(this->fd);
1589
1590                 this->print(this, buffer, sizeof(buffer));
1591                 radlog(L_ERR, "Failed binding to %s: %s\n",
1592                        buffer, strerror(errno));
1593                 return -1;
1594         }
1595
1596         /*
1597          *      FreeBSD jail issues.  We bind to 0.0.0.0, but the
1598          *      kernel instead binds us to a 1.2.3.4.  If this
1599          *      happens, notice, and remember our real IP.
1600          */
1601         {
1602                 struct sockaddr_storage src;
1603                 socklen_t               sizeof_src = sizeof(src);
1604
1605                 memset(&src, 0, sizeof_src);
1606                 if (getsockname(this->fd, (struct sockaddr *) &src,
1607                                 &sizeof_src) < 0) {
1608                         radlog(L_ERR, "Failed getting socket name: %s",
1609                                strerror(errno));
1610                         return -1;
1611                 }
1612
1613                 if (!fr_sockaddr2ipaddr(&src, sizeof_src,
1614                                         &sock->ipaddr, &sock->port)) {
1615                         radlog(L_ERR, "Socket has unsupported address family");
1616                         return -1;
1617                 }
1618         }
1619
1620 #ifdef O_NONBLOCK
1621         {
1622                 int flags;
1623
1624                 if ((flags = fcntl(this->fd, F_GETFL, NULL)) < 0)  {
1625                         radlog(L_ERR, "Failure getting socket flags: %s)\n",
1626                                strerror(errno));
1627                         return -1;
1628                 }
1629
1630                 flags |= O_NONBLOCK;
1631                 if( fcntl(this->fd, F_SETFL, flags) < 0) {
1632                         radlog(L_ERR, "Failure setting socket flags: %s)\n",
1633                                strerror(errno));
1634                         return -1;
1635                 }
1636         }
1637 #endif
1638
1639         return 0;
1640 }
1641
1642
1643 /*
1644  *      Allocate & initialize a new listener.
1645  */
1646 static rad_listen_t *listen_alloc(RAD_LISTEN_TYPE type)
1647 {
1648         rad_listen_t *this;
1649
1650         this = rad_malloc(sizeof(*this));
1651         memset(this, 0, sizeof(*this));
1652
1653         this->type = type;
1654         this->recv = master_listen[this->type].recv;
1655         this->send = master_listen[this->type].send;
1656         this->print = master_listen[this->type].print;
1657         this->encode = master_listen[this->type].encode;
1658         this->decode = master_listen[this->type].decode;
1659
1660         switch (type) {
1661 #ifdef WITH_STATS
1662         case RAD_LISTEN_NONE:
1663 #endif
1664         case RAD_LISTEN_AUTH:
1665 #ifdef WITH_ACCOUNTING
1666         case RAD_LISTEN_ACCT:
1667 #endif
1668 #ifdef WITH_PROXY
1669         case RAD_LISTEN_PROXY:
1670 #endif
1671 #ifdef WITH_VMPS
1672         case RAD_LISTEN_VQP:
1673 #endif
1674 #ifdef WITH_COA
1675         case RAD_LISTEN_COA:
1676 #endif
1677                 this->data = rad_malloc(sizeof(listen_socket_t));
1678                 memset(this->data, 0, sizeof(listen_socket_t));
1679                 break;
1680
1681 #ifdef WITH_DHCP
1682         case RAD_LISTEN_DHCP:
1683                 this->data = rad_malloc(sizeof(dhcp_socket_t));
1684                 memset(this->data, 0, sizeof(dhcp_socket_t));
1685                 break;
1686 #endif
1687
1688 #ifdef WITH_DETAIL
1689         case RAD_LISTEN_DETAIL:
1690                 this->data = NULL;
1691                 break;
1692 #endif
1693
1694 #ifdef WITH_COMMAND_SOCKET
1695         case RAD_LISTEN_COMMAND:
1696                 this->data = rad_malloc(sizeof(fr_command_socket_t));
1697                 memset(this->data, 0, sizeof(fr_command_socket_t));
1698                 break;
1699 #endif
1700
1701         default:
1702                 rad_assert("Unsupported option!" == NULL);
1703                 break;
1704         }
1705
1706         return this;
1707 }
1708
1709
1710 #ifdef WITH_PROXY
1711 /*
1712  *      Externally visible function for creating a new proxy LISTENER.
1713  *
1714  *      Not thread-safe, but all calls to it are protected by the
1715  *      proxy mutex in event.c
1716  */
1717 rad_listen_t *proxy_new_listener(fr_ipaddr_t *ipaddr, int exists)
1718 {
1719         rad_listen_t *this, *tmp, **last;
1720         listen_socket_t *sock, *old;
1721
1722         /*
1723          *      Find an existing proxy socket to copy.
1724          */
1725         old = NULL;
1726         last = &mainconfig.listen;
1727         for (tmp = mainconfig.listen; tmp != NULL; tmp = tmp->next) {
1728                 /*
1729                  *      Not proxy, ignore it.
1730                  */
1731                 if (tmp->type != RAD_LISTEN_PROXY) goto next;
1732
1733                 sock = tmp->data;
1734
1735                 /*
1736                  *      If we were asked to copy a specific one, do
1737                  *      so.  If we're just finding one that already
1738                  *      exists, return a pointer to it.  Otherwise,
1739                  *      create ANOTHER one with the same IP address.
1740                  */
1741                 if ((ipaddr->af != AF_UNSPEC) &&
1742                     (fr_ipaddr_cmp(&sock->ipaddr, ipaddr) != 0)) {
1743                         if (exists) return tmp;
1744                         goto next;
1745                 }
1746
1747                 if (!old) old = sock;
1748
1749         next:
1750                 last = &(tmp->next);
1751         }
1752
1753         this = listen_alloc(RAD_LISTEN_PROXY);
1754         sock = this->data;
1755
1756         if (!old) {
1757                 /*
1758                  *      The socket MUST already exist if we're binding
1759                  *      to an address while proxying.
1760                  *
1761                  *      If we're initializing the server, it's OK for the
1762                  *      socket to NOT exist.
1763                  */
1764                 if (!exists) {
1765                         DEBUG("WARNING: No previous template for proxy socket.  Source IP address may be chosen by the OS");
1766                 }
1767
1768                 if (ipaddr->af != AF_UNSPEC) {
1769                         sock->ipaddr = *ipaddr;
1770                 } else {
1771                         memset(&sock->ipaddr, 0, sizeof(sock->ipaddr));
1772                         sock->ipaddr.af = AF_INET; /* Oh well */
1773                 }
1774         } else {
1775                 sock->ipaddr = old->ipaddr;
1776         }
1777
1778         sock->port = 0;
1779
1780         if (listen_bind(this) >= 0) {
1781                 /*
1782                  *      Add the new listener to the list of
1783                  *      listeners.
1784                  */
1785                 *last = this;
1786                 return this;
1787         }
1788
1789         DEBUG("Failed binding to new proxy socket");
1790         listen_free(&this);
1791         return NULL;
1792 }
1793 #endif
1794
1795 static const FR_NAME_NUMBER listen_compare[] = {
1796 #ifdef WITH_STATS
1797         { "status",     RAD_LISTEN_NONE },
1798 #endif
1799         { "auth",       RAD_LISTEN_AUTH },
1800 #ifdef WITH_ACCOUNTING
1801         { "acct",       RAD_LISTEN_ACCT },
1802 #endif
1803 #ifdef WITH_DETAIL
1804         { "detail",     RAD_LISTEN_DETAIL },
1805 #endif
1806 #ifdef WITH_PROXY
1807         { "proxy",      RAD_LISTEN_PROXY },
1808 #endif
1809 #ifdef WITH_VMPS
1810         { "vmps",       RAD_LISTEN_VQP },
1811 #endif
1812 #ifdef WITH_DHCP
1813         { "dhcp",       RAD_LISTEN_DHCP },
1814 #endif
1815 #ifdef WITH_COMMAND_SOCKET
1816         { "control",    RAD_LISTEN_COMMAND },
1817 #endif
1818 #ifdef WITH_COA
1819         { "coa",        RAD_LISTEN_COA },
1820 #endif
1821         { NULL, 0 },
1822 };
1823
1824
1825 static rad_listen_t *listen_parse(CONF_SECTION *cs, const char *server)
1826 {
1827         int             type, rcode;
1828         char            *listen_type;
1829         rad_listen_t    *this;
1830
1831         listen_type = NULL;
1832
1833         cf_log_info(cs, "listen {");
1834
1835         rcode = cf_item_parse(cs, "type", PW_TYPE_STRING_PTR,
1836                               &listen_type, "");
1837         if (rcode < 0) return NULL;
1838         if (rcode == 1) {
1839                 free(listen_type);
1840                 cf_log_err(cf_sectiontoitem(cs),
1841                            "No type specified in listen section");
1842                 return NULL;
1843         }
1844
1845         type = fr_str2int(listen_compare, listen_type, -1);
1846         if (type < 0) {
1847                 cf_log_err(cf_sectiontoitem(cs),
1848                            "Invalid type \"%s\" in listen section.",
1849                            listen_type);
1850                 free(listen_type);
1851                 return NULL;
1852         }
1853         free(listen_type);
1854
1855         /*
1856          *      Allow listen sections in the default config to
1857          *      refer to a server.
1858          */
1859         if (!server) {
1860                 rcode = cf_item_parse(cs, "virtual_server", PW_TYPE_STRING_PTR,
1861                                       &server, NULL);
1862                 if (rcode == 1) { /* compatiblity with 2.0-pre */
1863                         rcode = cf_item_parse(cs, "server", PW_TYPE_STRING_PTR,
1864                                               &server, NULL);
1865                 }
1866                 if (rcode < 0) return NULL;
1867         }
1868
1869         /*
1870          *      Set up cross-type data.
1871          */
1872         this = listen_alloc(type);
1873         this->server = server;
1874         this->fd = -1;
1875
1876         /*
1877          *      Call per-type parser.
1878          */
1879         if (master_listen[type].parse(cs, this) < 0) {
1880                 listen_free(&this);
1881                 return NULL;
1882         }
1883
1884         cf_log_info(cs, "}");
1885
1886         return this;
1887 }
1888
1889 /*
1890  *      Generate a list of listeners.  Takes an input list of
1891  *      listeners, too, so we don't close sockets with waiting packets.
1892  */
1893 int listen_init(CONF_SECTION *config, rad_listen_t **head)
1894 {
1895         int             override = FALSE;
1896         int             rcode;
1897         CONF_SECTION    *cs = NULL;
1898         rad_listen_t    **last;
1899         rad_listen_t    *this;
1900         fr_ipaddr_t     server_ipaddr;
1901         int             auth_port = 0;
1902 #ifdef WITH_PROXY
1903         int             defined_proxy = 0;
1904 #endif
1905
1906         /*
1907          *      We shouldn't be called with a pre-existing list.
1908          */
1909         rad_assert(head && (*head == NULL));
1910
1911         last = head;
1912         server_ipaddr.af = AF_UNSPEC;
1913
1914         /*
1915          *      If the port is specified on the command-line,
1916          *      it over-rides the configuration file.
1917          *
1918          *      FIXME: If argv[0] == "vmpsd", then don't listen on auth/acct!
1919          */
1920         if (mainconfig.port >= 0) auth_port = mainconfig.port;
1921
1922         /*
1923          *      If the IP address was configured on the command-line,
1924          *      use that as the "bind_address"
1925          */
1926         if (mainconfig.myip.af != AF_UNSPEC) {
1927                 memcpy(&server_ipaddr, &mainconfig.myip,
1928                        sizeof(server_ipaddr));
1929                 override = TRUE;
1930                 goto bind_it;
1931         }
1932
1933         /*
1934          *      Else look for bind_address and/or listen sections.
1935          */
1936         server_ipaddr.ipaddr.ip4addr.s_addr = htonl(INADDR_NONE);
1937         rcode = cf_item_parse(config, "bind_address",
1938                               PW_TYPE_IPADDR,
1939                               &server_ipaddr.ipaddr.ip4addr, NULL);
1940         if (rcode < 0) return -1; /* error parsing it */
1941
1942         if (rcode == 0) { /* successfully parsed IPv4 */
1943                 listen_socket_t *sock;
1944                 server_ipaddr.af = AF_INET;
1945
1946                 radlog(L_INFO, "WARNING: The directive 'bind_address' is deprecated, and will be removed in future versions of FreeRADIUS. Please edit the configuration files to use the directive 'listen'.");
1947
1948         bind_it:
1949 #ifdef WITH_VMPS
1950                 if (strcmp(progname, "vmpsd") == 0) {
1951                         this = listen_alloc(RAD_LISTEN_VQP);
1952                         if (!auth_port) auth_port = 1589;
1953                 } else
1954 #endif
1955                         this = listen_alloc(RAD_LISTEN_AUTH);
1956
1957                 sock = this->data;
1958
1959                 sock->ipaddr = server_ipaddr;
1960                 sock->port = auth_port;
1961
1962                 sock->clients = clients_parse_section(config);
1963                 if (!sock->clients) {
1964                         cf_log_err(cf_sectiontoitem(config),
1965                                    "Failed to find any clients for this listen section");
1966                         listen_free(&this);
1967                         return -1;
1968                 }
1969
1970                 if (listen_bind(this) < 0) {
1971                         listen_free(head);
1972                         radlog(L_ERR, "There appears to be another RADIUS server running on the authentication port %d", sock->port);
1973                         listen_free(&this);
1974                         return -1;
1975                 }
1976                 auth_port = sock->port; /* may have been updated in listen_bind */
1977                 if (override) {
1978                         cs = cf_section_sub_find_name2(config, "server",
1979                                                        mainconfig.name);
1980                         if (cs) this->server = mainconfig.name;
1981                 }
1982
1983                 *last = this;
1984                 last = &(this->next);
1985
1986 #ifdef WITH_VMPS
1987                 /*
1988                  *      No acct for vmpsd
1989                  */
1990                 if (strcmp(progname, "vmpsd") == 0) goto do_proxy;
1991 #endif
1992
1993 #ifdef WITH_ACCOUNTING
1994                 /*
1995                  *      Open Accounting Socket.
1996                  *
1997                  *      If we haven't already gotten acct_port from
1998                  *      /etc/services, then make it auth_port + 1.
1999                  */
2000                 this = listen_alloc(RAD_LISTEN_ACCT);
2001                 sock = this->data;
2002
2003                 /*
2004                  *      Create the accounting socket.
2005                  *
2006                  *      The accounting port is always the
2007                  *      authentication port + 1
2008                  */
2009                 sock->ipaddr = server_ipaddr;
2010                 sock->port = auth_port + 1;
2011
2012                 sock->clients = clients_parse_section(config);
2013                 if (!sock->clients) {
2014                         cf_log_err(cf_sectiontoitem(config),
2015                                    "Failed to find any clients for this listen section");
2016                         return -1;
2017                 }
2018
2019                 if (listen_bind(this) < 0) {
2020                         listen_free(&this);
2021                         listen_free(head);
2022                         radlog(L_ERR, "There appears to be another RADIUS server running on the accounting port %d", sock->port);
2023                         return -1;
2024                 }
2025
2026                 if (override) {
2027                         cs = cf_section_sub_find_name2(config, "server",
2028                                                        mainconfig.name);
2029                         if (cs) this->server = mainconfig.name;
2030                 }
2031
2032                 *last = this;
2033                 last = &(this->next);
2034 #endif
2035         } else if (mainconfig.port > 0) { /* no bind address, but a port */
2036                 radlog(L_ERR, "The command-line says \"-p %d\", but there is no associated IP address to use",
2037                        mainconfig.port);
2038                 return -1;
2039         }
2040
2041         /*
2042          *      They specified an IP on the command-line, ignore
2043          *      all listen sections except the one in '-n'.
2044          */
2045         if (mainconfig.myip.af != AF_UNSPEC) {
2046                 CONF_SECTION *subcs;
2047                 const char *name2 = cf_section_name2(cs);
2048
2049                 cs = cf_section_sub_find_name2(config, "server",
2050                                                mainconfig.name);
2051                 if (!cs) goto do_proxy;
2052
2053                 /*
2054                  *      Should really abstract this code...
2055                  */
2056                 for (subcs = cf_subsection_find_next(cs, NULL, "listen");
2057                      subcs != NULL;
2058                      subcs = cf_subsection_find_next(cs, subcs, "listen")) {
2059                         this = listen_parse(subcs, name2);
2060                         if (!this) {
2061                                 listen_free(head);
2062                                 return -1;
2063                         }
2064
2065 #ifdef WITH_PROXY
2066                         if (this->type == RAD_LISTEN_PROXY) defined_proxy = 1;
2067 #endif
2068
2069                         *last = this;
2070                         last = &(this->next);
2071                 } /* loop over "listen" directives in server <foo> */
2072
2073                 goto do_proxy;
2074         }
2075
2076         /*
2077          *      Walk through the "listen" sections, if they exist.
2078          */
2079         for (cs = cf_subsection_find_next(config, NULL, "listen");
2080              cs != NULL;
2081              cs = cf_subsection_find_next(config, cs, "listen")) {
2082                 this = listen_parse(cs, NULL);
2083                 if (!this) {
2084                         listen_free(head);
2085                         return -1;
2086                 }
2087
2088 #ifdef WITH_PROXY
2089                 if (this->type == RAD_LISTEN_PROXY) defined_proxy = 1;
2090 #endif
2091
2092                 *last = this;
2093                 last = &(this->next);
2094         }
2095
2096         /*
2097          *      Check virtual servers for "listen" sections, too.
2098          *
2099          *      FIXME: Move to virtual server init?
2100          */
2101         for (cs = cf_subsection_find_next(config, NULL, "server");
2102              cs != NULL;
2103              cs = cf_subsection_find_next(config, cs, "server")) {
2104                 CONF_SECTION *subcs;
2105                 const char *name2 = cf_section_name2(cs);
2106
2107                 for (subcs = cf_subsection_find_next(cs, NULL, "listen");
2108                      subcs != NULL;
2109                      subcs = cf_subsection_find_next(cs, subcs, "listen")) {
2110                         this = listen_parse(subcs, name2);
2111                         if (!this) {
2112                                 listen_free(head);
2113                                 return -1;
2114                         }
2115
2116 #ifdef WITH_PROXY
2117                         if (this->type == RAD_LISTEN_PROXY) {
2118                                 radlog(L_ERR, "Error: listen type \"proxy\" Cannot appear in a virtual server section");
2119                                 listen_free(head);
2120                                 return -1;
2121                         }
2122 #endif
2123
2124                         *last = this;
2125                         last = &(this->next);
2126                 } /* loop over "listen" directives in virtual servers */
2127         } /* loop over virtual servers */
2128
2129         /*
2130          *      If we're proxying requests, open the proxy FD.
2131          *      Otherwise, don't do anything.
2132          */
2133  do_proxy:
2134         /*
2135          *      No sockets to receive packets, this is an error.
2136          *      proxying is pointless.
2137          */
2138         if (!*head) {
2139                 radlog(L_ERR, "The server is not configured to listen on any ports.  Cannot start.");
2140                 return -1;
2141         }
2142
2143 #ifdef WITH_PROXY
2144         if (mainconfig.proxy_requests == TRUE) {
2145                 int             port = -1;
2146                 listen_socket_t *sock = NULL;
2147
2148                 if (defined_proxy) goto check_home_servers;
2149
2150                 /*
2151                  *      Find the first authentication port,
2152                  *      and use it
2153                  */
2154                 for (this = *head; this != NULL; this = this->next) {
2155                         if (this->type == RAD_LISTEN_AUTH) {
2156                                 sock = this->data;
2157
2158                                 /*
2159                                  *      We shouldn't proxy on loopback.
2160                                  */
2161                                 if ((sock->ipaddr.af == AF_INET) &&
2162                                     (sock->ipaddr.ipaddr.ip4addr.s_addr == htonl(INADDR_LOOPBACK))) continue;
2163
2164
2165 #ifdef HAVE_STRUCT_SOCKADDR_IN6
2166                                 if ((sock->ipaddr.af == AF_INET6) &&
2167                                     (IN6_IS_ADDR_LINKLOCAL(&sock->ipaddr.ipaddr.ip6addr))) continue;
2168 #endif
2169
2170                                 if (server_ipaddr.af == AF_UNSPEC) {
2171                                         server_ipaddr = sock->ipaddr;
2172                                 }
2173                                 port = sock->port + 2; /* skip acct port */
2174                                 break;
2175                         }
2176 #ifdef WITH_VMPS
2177                         if (this->type == RAD_LISTEN_VQP) {
2178                                 sock = this->data;
2179                                 if (server_ipaddr.af == AF_UNSPEC) {
2180                                         server_ipaddr = sock->ipaddr;
2181                                 }
2182                                 port = sock->port + 1;
2183                                 break;
2184                         }
2185 #endif
2186                 }
2187
2188                 if (port < 0) port = 1024 + (fr_rand() & 0x1ff);
2189
2190                 /*
2191                  *      Address is still unspecified, use IPv4.
2192                  */
2193                 if (server_ipaddr.af == AF_UNSPEC) {
2194                         server_ipaddr.af = AF_INET;
2195                         server_ipaddr.ipaddr.ip4addr.s_addr = htonl(INADDR_ANY);
2196                 }
2197
2198                 this = listen_alloc(RAD_LISTEN_PROXY);
2199                 sock = this->data;
2200
2201                 /*
2202                  *      Create the first proxy socket.
2203                  */
2204                 sock->ipaddr = server_ipaddr;
2205
2206                 /*
2207                  *      Try to find a proxy port (value doesn't matter)
2208                  */
2209                 for (sock->port = port;
2210                      sock->port < 64000;
2211                      sock->port++) {
2212                         if (listen_bind(this) == 0) {
2213                                 *last = this;
2214                                 last = &(this->next); /* just in case */
2215                                 break;
2216                         }
2217                 }
2218
2219                 if (sock->port >= 64000) {
2220                         listen_free(head);
2221                         listen_free(&this);
2222                         radlog(L_ERR, "Failed to open socket for proxying");
2223                         return -1;
2224                 }
2225
2226                 /*
2227                  *      Create *additional* proxy listeners, based
2228                  *      on their src_ipaddr.
2229                  */
2230         check_home_servers:
2231                 if (home_server_create_listeners() != 0) return -1;
2232         }
2233 #endif
2234
2235         return 0;
2236 }
2237
2238 /*
2239  *      Free a linked list of listeners;
2240  */
2241 void listen_free(rad_listen_t **head)
2242 {
2243         rad_listen_t *this;
2244
2245         if (!head || !*head) return;
2246
2247         this = *head;
2248         while (this) {
2249                 rad_listen_t *next = this->next;
2250
2251                 /*
2252                  *      Other code may have eaten the FD.
2253                  */
2254                 if (this->fd >= 0) close(this->fd);
2255
2256                 if (master_listen[this->type].free) {
2257                         master_listen[this->type].free(this);
2258                 }
2259                 free(this->data);
2260                 free(this);
2261
2262                 this = next;
2263         }
2264
2265         *head = NULL;
2266 }
2267
2268 #ifdef WITH_STATS
2269 RADCLIENT_LIST *listener_find_client_list(const fr_ipaddr_t *ipaddr,
2270                                           int port)
2271 {
2272         rad_listen_t *this;
2273
2274         for (this = mainconfig.listen; this != NULL; this = this->next) {
2275                 listen_socket_t *sock;
2276
2277                 if ((this->type != RAD_LISTEN_AUTH) &&
2278                     (this->type != RAD_LISTEN_ACCT)) continue;
2279
2280                 sock = this->data;
2281
2282                 if ((sock->port == port) &&
2283                     (fr_ipaddr_cmp(ipaddr, &sock->ipaddr) == 0)) {
2284                         return sock->clients;
2285                 }
2286         }
2287
2288         return NULL;
2289 }
2290 #endif
2291
2292 rad_listen_t *listener_find_byipaddr(const fr_ipaddr_t *ipaddr, int port)
2293 {
2294         rad_listen_t *this;
2295
2296         for (this = mainconfig.listen; this != NULL; this = this->next) {
2297                 listen_socket_t *sock;
2298
2299                 /*
2300                  *      FIXME: For TCP, ignore the *secondary*
2301                  *      listeners associated with the main socket.
2302                  */
2303                 if ((this->type != RAD_LISTEN_AUTH) &&
2304                     (this->type != RAD_LISTEN_ACCT)) continue;
2305
2306                 sock = this->data;
2307
2308                 if ((sock->port == port) &&
2309                     (fr_ipaddr_cmp(ipaddr, &sock->ipaddr) == 0)) {
2310                         return this;
2311                 }
2312
2313                 if ((sock->port == port) &&
2314                     ((sock->ipaddr.af == AF_INET) &&
2315                      (sock->ipaddr.ipaddr.ip4addr.s_addr == INADDR_ANY))) {
2316                         return this;
2317                 }
2318
2319 #ifdef HAVE_STRUCT_SOCKADDR_IN6
2320                 if ((sock->port == port) &&
2321                     (sock->ipaddr.af == AF_INET6) &&
2322                     (IN6_IS_ADDR_UNSPECIFIED(&sock->ipaddr.ipaddr.ip6addr))) {
2323                         return this;
2324                 }
2325 #endif
2326         }
2327
2328         return NULL;
2329 }