radict.mk \
radiusd.mk \
radsniff.mk \
- radmin.mk \
radwho.mk \
radsnmp.mk \
radlast.mk \
TARGET := radiusd
SOURCES := \
auth.c \
- conduit.c \
client.c \
crypt.c \
users_file.c \
--- /dev/null
+SUBMAKEFILES := proto_control.mk proto_control_tcp.mk proto_control_unix.mk libfreeradius-control.mk radmin.mk
RCSID("$Id$")
#include <freeradius-devel/radiusd.h>
-#include <freeradius-devel/conduit.h>
+#include "conduit.h"
typedef struct rconduit_t {
uint32_t conduit;
--- /dev/null
+TARGET := libfreeradius-control.a
+
+SOURCES := conduit.c
+
+SRC_CFLAGS :=
--- /dev/null
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/**
+ * $Id$
+ * @file proto_control.c
+ * @brief CONTROL master protocol handler.
+ *
+ * @copyright 2018 Alan DeKok (aland@freeradius.org)
+ */
+#include <freeradius-devel/radiusd.h>
+#include <freeradius-devel/radius/radius.h>
+#include <freeradius-devel/io/listen.h>
+#include <freeradius-devel/modules.h>
+#include <freeradius-devel/unlang.h>
+#include <freeradius-devel/rad_assert.h>
+#include "proto_control.h"
+
+extern fr_app_t proto_control;
+static int type_parse(TALLOC_CTX *ctx, void *out, CONF_ITEM *ci, CONF_PARSER const *rule);
+static int transport_parse(TALLOC_CTX *ctx, void *out, CONF_ITEM *ci, CONF_PARSER const *rule);
+
+static CONF_PARSER const limit_config[] = {
+ { FR_CONF_OFFSET("idle_timeout", FR_TYPE_TIMEVAL, proto_control_t, io.idle_timeout), .dflt = "30.0" } ,
+ { FR_CONF_OFFSET("nak_lifetime", FR_TYPE_TIMEVAL, proto_control_t, io.nak_lifetime), .dflt = "30.0" } ,
+
+ { FR_CONF_OFFSET("max_connections", FR_TYPE_UINT32, proto_control_t, io.max_connections), .dflt = "1024" } ,
+ { FR_CONF_OFFSET("max_clients", FR_TYPE_UINT32, proto_control_t, io.max_clients), .dflt = "256" } ,
+ { FR_CONF_OFFSET("max_pending_packets", FR_TYPE_UINT32, proto_control_t, io.max_pending_packets), .dflt = "256" } ,
+
+ /*
+ * For performance tweaking. NOT for normal humans.
+ */
+ { FR_CONF_OFFSET("max_packet_size", FR_TYPE_UINT32, proto_control_t, max_packet_size) } ,
+ { FR_CONF_OFFSET("num_messages", FR_TYPE_UINT32, proto_control_t, num_messages) } ,
+
+ CONF_PARSER_TERMINATOR
+};
+
+/** How to parse a CONTROL listen section
+ *
+ */
+static CONF_PARSER const proto_control_config[] = {
+ { FR_CONF_OFFSET("type", FR_TYPE_VOID | FR_TYPE_MULTI | FR_TYPE_NOT_EMPTY, proto_control_t,
+ type_submodule), .func = type_parse },
+ { FR_CONF_OFFSET("transport", FR_TYPE_VOID, proto_control_t, io.submodule),
+ .func = transport_parse },
+
+ { FR_CONF_POINTER("limit", FR_TYPE_SUBSECTION, NULL), .subcs = (void const *) limit_config },
+ CONF_PARSER_TERMINATOR
+};
+
+static fr_dict_t *dict_control;
+
+extern fr_dict_autoload_t proto_control_dict[];
+fr_dict_autoload_t proto_control_dict[] = {
+ { .out = &dict_control, .proto = "internal" },
+ { NULL }
+};
+
+#if 0
+static fr_dict_attr_t const *attr_control_packet_type;
+
+extern fr_dict_attr_autoload_t proto_control_dict_attr[];
+fr_dict_attr_autoload_t proto_control_dict_attr[] = {
+ { .out = &attr_control_packet_type, .name = "CONTROL-Packet-Type", .type = FR_TYPE_UINT32, .dict = &dict_control},
+ { NULL }
+};
+#endif
+
+/** Wrapper around dl_instance which translates the packet-type into a submodule name
+ *
+ * @param[in] ctx to allocate data in (instance of proto_control).
+ * @param[out] out Where to write a dl_instance_t containing the module handle and instance.
+ * @param[in] ci #CONF_PAIR specifying the name of the type module.
+ * @param[in] rule unused.
+ * @return
+ * - 0 on success.
+ * - -1 on failure.
+ */
+static int type_parse(TALLOC_CTX *ctx, void *out, CONF_ITEM *ci, UNUSED CONF_PARSER const *rule)
+{
+// char const *type_str = cf_pair_value(cf_item_to_pair(ci));
+ CONF_SECTION *listen_cs = cf_item_to_section(cf_parent(ci));
+// CONF_SECTION *server = cf_item_to_section(cf_parent(listen_cs));
+// proto_control_t *inst;
+ dl_instance_t *parent_inst;
+// fr_dict_enum_t const *type_enum;
+
+ rad_assert(listen_cs && (strcmp(cf_section_name1(listen_cs), "listen") == 0));
+ /*
+ * Parent dl_instance_t added in virtual_servers.c (listen_parse)
+ *
+ * We just load proto_control_all.a
+ *
+ * Future changes may allow different types of control access?
+ */
+ return dl_instance(ctx, out, listen_cs, parent_inst, "all", DL_TYPE_SUBMODULE);
+}
+
+/** Wrapper around dl_instance
+ *
+ * @param[in] ctx to allocate data in (instance of proto_control).
+ * @param[out] out Where to write a dl_instance_t containing the module handle and instance.
+ * @param[in] ci #CONF_PAIR specifying the name of the type module.
+ * @param[in] rule unused.
+ * @return
+ * - 0 on success.
+ * - -1 on failure.
+ */
+static int transport_parse(TALLOC_CTX *ctx, void *out, CONF_ITEM *ci, UNUSED CONF_PARSER const *rule)
+{
+ char const *name = cf_pair_value(cf_item_to_pair(ci));
+ dl_instance_t *parent_inst;
+ proto_control_t *inst;
+ CONF_SECTION *listen_cs = cf_item_to_section(cf_parent(ci));
+ CONF_SECTION *transport_cs;
+
+ transport_cs = cf_section_find(listen_cs, name, NULL);
+
+ /*
+ * Allocate an empty section if one doesn't exist
+ * this is so defaults get parsed.
+ */
+ if (!transport_cs) transport_cs = cf_section_alloc(listen_cs, listen_cs, name, NULL);
+
+ parent_inst = cf_data_value(cf_data_find(listen_cs, dl_instance_t, "proto_control"));
+ rad_assert(parent_inst);
+
+ /*
+ * Set the allowed codes so that we can compile them as
+ * necessary.
+ */
+ inst = talloc_get_type_abort(parent_inst->data, proto_control_t);
+ inst->io.transport = name;
+
+ return dl_instance(ctx, out, transport_cs, parent_inst, name, DL_TYPE_SUBMODULE);
+}
+
+/** Decode the packet
+ *
+ */
+static int mod_decode(void const *instance, REQUEST *request, uint8_t *const data, size_t data_len)
+{
+ proto_control_t const *inst = talloc_get_type_abort_const(instance, proto_control_t);
+ fr_io_track_t const *track = talloc_get_type_abort_const(request->async->packet_ctx, fr_io_track_t);
+ fr_io_address_t *address = track->address;
+ RADCLIENT const *client;
+
+ rad_assert(data[0] < FR_MAX_PACKET_CODE);
+
+ /*
+ * Set the request dictionary so that we can do
+ * generic->protocol attribute conversions as
+ * the request runs through the server.
+ */
+ request->dict = dict_control;
+
+ client = address->radclient;
+
+ /*
+ * Hacks for now until we have a lower-level decode routine.
+ */
+ request->packet->code = data[0];
+ request->packet->id = data[1];
+ request->reply->id = data[1];
+ memcpy(request->packet->vector, data + 4, sizeof(request->packet->vector));
+
+ request->packet->data = talloc_memdup(request->packet, data, data_len);
+ request->packet->data_len = data_len;
+
+ /*
+ * Note that we don't set a limit on max_attributes here.
+ * That MUST be set and checked in the underlying
+ * transport.
+ *
+ * @todo - decode the input control packet, instead of
+ * this temporary hack.
+ */
+ if (data_len > 0) {
+ RPEDEBUG("Failed decoding packet");
+ return -1;
+ }
+
+ /*
+ * Set the rest of the fields.
+ */
+ memcpy(&request->client, &client, sizeof(client)); /* const issues */
+
+ request->packet->if_index = address->if_index;
+ request->packet->src_ipaddr = address->src_ipaddr;
+ request->packet->src_port = address->src_port;
+ request->packet->dst_ipaddr = address->dst_ipaddr;
+ request->packet->dst_port = address->dst_port;
+
+ request->reply->if_index = address->if_index;
+ request->reply->src_ipaddr = address->dst_ipaddr;
+ request->reply->src_port = address->dst_port;
+ request->reply->dst_ipaddr = address->src_ipaddr;
+ request->reply->dst_port = address->src_port;
+
+ request->root = &main_config;
+ REQUEST_VERIFY(request);
+
+ if (!inst->io.app_io->decode) return 0;
+
+ /*
+ * Let the app_io do anything it needs to do.
+ */
+ return inst->io.app_io->decode(inst->io.app_io_instance, request, data, data_len);
+}
+
+static ssize_t mod_encode(void const *instance, REQUEST *request, uint8_t *buffer, size_t buffer_len)
+{
+ proto_control_t const *inst = talloc_get_type_abort_const(instance, proto_control_t);
+ fr_io_track_t const *track = talloc_get_type_abort_const(request->async->packet_ctx, fr_io_track_t);
+ fr_io_address_t *address = track->address;
+ ssize_t data_len;
+ RADCLIENT const *client;
+
+ /*
+ * The packet timed out. Tell the network side that the packet is dead.
+ */
+ if (buffer_len == 1) {
+ *buffer = true;
+ return 1;
+ }
+
+ /*
+ * "Do not respond"
+ */
+ if ((request->reply->code == FR_CODE_DO_NOT_RESPOND) ||
+ (request->reply->code == 0) || (request->reply->code >= FR_MAX_PACKET_CODE)) {
+ *buffer = false;
+ return 1;
+ }
+
+ client = address->radclient;
+ rad_assert(client);
+
+ /*
+ * Dynamic client stuff
+ */
+ if (client->dynamic && !client->active) {
+ RADCLIENT *new_client;
+
+ rad_assert(buffer_len >= sizeof(client));
+
+ /*
+ * Allocate the client. If that fails, send back a NAK.
+ *
+ * @todo - deal with NUMA zones? Or just deal with this
+ * client being in different memory.
+ *
+ * Maybe we should create a CONF_SECTION from the client,
+ * and pass *that* back to mod_write(), which can then
+ * parse it to create the actual client....
+ */
+ new_client = client_afrom_request(NULL, request);
+ if (!new_client) {
+ PERROR("Failed creating new client");
+ buffer[0] = true;
+ return 1;
+ }
+
+ memcpy(buffer, &new_client, sizeof(new_client));
+ return sizeof(new_client);
+ }
+
+ /*
+ * If the app_io encodes the packet, then we don't need
+ * to do that.
+ */
+ if (inst->io.app_io->encode) {
+ data_len = inst->io.app_io->encode(inst->io.app_io_instance, request, buffer, buffer_len);
+ if (data_len > 0) return data_len;
+ }
+
+#ifdef WITH_UDPFROMTO
+ /*
+ * Overwrite the src ip address on the outbound packet
+ * with the one specified by the client. This is useful
+ * to work around broken DSR implementations and other
+ * routing issues.
+ */
+ if (client->src_ipaddr.af != AF_UNSPEC) {
+ request->reply->src_ipaddr = client->src_ipaddr;
+ }
+#endif
+
+ /*
+ * @todo - encode the reply.
+ *
+ * If the reply is too large, find a way to gradually
+ * write it to the network side?
+ */
+#if 0
+ data_len = fr_control_encode(buffer, buffer_len, request->packet->data,
+ request->reply->code, request->reply->id, request->reply->vps);
+#else
+ data_len = -1;
+#endif
+ if (data_len < 0) {
+ RPEDEBUG("Failed encoding CONTROL reply");
+ return -1;
+ }
+
+ return data_len;
+}
+
+static void mod_entry_point_set(void const *instance, REQUEST *request)
+{
+ proto_control_t const *inst = talloc_get_type_abort_const(instance, proto_control_t);
+ fr_io_track_t *track = request->async->packet_ctx;
+
+ request->server_cs = inst->io.server_cs;
+
+ /*
+ * 'track' can be NULL when there's no network listener.
+ */
+ if (inst->io.app_io && (track->dynamic == request->async->recv_time)) {
+ fr_app_worker_t const *app_process;
+
+ app_process = (fr_app_worker_t const *) inst->dynamic_submodule->module->common;
+
+ request->async->process = app_process->entry_point;
+ track->dynamic = 0;
+ return;
+ }
+
+ rad_assert(inst->process != NULL);
+ request->async->process = inst->process;
+}
+
+
+static int mod_priority_set(UNUSED void const *instance, UNUSED uint8_t const *buffer, UNUSED size_t buflen)
+{
+ return PRIORITY_NOW;
+}
+
+/** Open listen sockets/connect to external event source
+ *
+ * @param[in] instance Ctx data for this application.
+ * @param[in] sc to add our file descriptor to.
+ * @param[in] conf Listen section parsed to give us isntance.
+ * @return
+ * - 0 on success.
+ * - -1 on failure.
+ */
+static int mod_open(void *instance, fr_schedule_t *sc, CONF_SECTION *conf)
+{
+ fr_listen_t *listen;
+ proto_control_t *inst = talloc_get_type_abort(instance, proto_control_t);
+
+ /*
+ * Build the #fr_listen_t. This describes the complete
+ * path, data takes from the socket to the decoder and
+ * back again.
+ */
+ listen = talloc_zero(inst, fr_listen_t);
+
+ listen->app = &proto_control;
+ listen->app_instance = instance;
+ listen->server_cs = inst->io.server_cs;
+
+ /*
+ * Set configurable parameters for message ring buffer.
+ */
+ listen->default_message_size = inst->max_packet_size;
+ listen->num_messages = inst->num_messages;
+
+ /*
+ * Open the socket, and add it to the scheduler.
+ */
+ if (inst->io.app_io) {
+ /*
+ * Set the listener to call our master trampoline function.
+ */
+ listen->app_io = &fr_master_app_io;
+ listen->app_io_instance = inst;
+
+ /*
+ * Don't set the connection for the main socket. It's not connected.
+ */
+ if (inst->io.app_io->open(inst->io.app_io_instance) < 0) {
+ cf_log_err(conf, "Failed opening %s interface", inst->io.app_io->name);
+ talloc_free(listen);
+ return -1;
+ }
+
+ /*
+ * Add the socket to the scheduler, which might
+ * end up in a different thread.
+ */
+ if (!fr_schedule_socket_add(sc, listen)) {
+ talloc_free(listen);
+ return -1;
+ }
+ } else {
+ rad_assert(!inst->io.dynamic_clients);
+ }
+
+ inst->io.listen = listen; /* Probably won't need it, but doesn't hurt */
+ inst->io.sc = sc;
+
+ return 0;
+}
+
+/** Instantiate the application
+ *
+ * Instantiate I/O and type submodules.
+ *
+ * @param[in] instance Ctx data for this application.
+ * @param[in] conf Listen section parsed to give us instance.
+ * @return
+ * - 0 on success.
+ * - -1 on failure.
+ */
+static int mod_instantiate(void *instance, CONF_SECTION *conf)
+{
+ proto_control_t *inst = talloc_get_type_abort(instance, proto_control_t);
+ size_t i;
+
+ CONF_PAIR *cp = NULL;
+ CONF_ITEM *ci;
+ CONF_SECTION *server = cf_item_to_section(cf_parent(conf));
+
+ /*
+ * Compile each "send/recv + CONTROL packet type" section.
+ * This is so that the submodules don't need to do this.
+ */
+ i = 0;
+ for (ci = cf_item_next(server, NULL);
+ ci != NULL;
+ ci = cf_item_next(server, ci)) {
+ char const *name, *packet_type;
+ CONF_SECTION *subcs;
+ rlm_components_t component = MOD_AUTHORIZE;
+
+ if (!cf_item_is_section(ci)) continue;
+
+ subcs = cf_item_to_section(ci);
+ name = cf_section_name1(subcs);
+
+ /*
+ * We only process recv/send sections.
+ * proto_control_auth will handle the
+ * "authenticate" sections.
+ */
+ if ((strcmp(name, "recv") != 0) &&
+ (strcmp(name, "send") != 0)) {
+ continue;
+ }
+
+ /*
+ * One more "recv" or "send" section has been
+ * found.
+ */
+ i++;
+
+ /*
+ * Skip a section if it was already compiled.
+ */
+ if (cf_data_find(subcs, unlang_group_t, NULL) != NULL) continue;
+
+ /*
+ * Check that the packet type is known.
+ */
+ packet_type = cf_section_name2(subcs);
+ if (packet_type) {
+ cf_log_err(subcs, "Invalid control packet type in '%s %s {...}'",
+ name, packet_type);
+ return -1;
+ }
+
+ /*
+ * Try to compile it, and fail if it doesn't work.
+ */
+ cf_log_debug(subcs, "compiling - %s {...}", name);
+
+ if (strcmp(name, "send") == 0) component = MOD_POST_AUTH;
+
+ if (unlang_compile(subcs, component) < 0) {
+ cf_log_err(subcs, "Failed compiling '%s { ... }' section", name);
+ return -1;
+ }
+ }
+
+ /*
+ * No 'recv' or 'send' sections. That's an error.
+ */
+ if (!i) {
+ cf_log_err(server, "Virtual servers cannot be empty.");
+ return -1;
+ }
+
+ /*
+ * Instantiate the process modules
+ */
+ i = 0;
+ while ((cp = cf_pair_find_next(conf, cp, "type"))) {
+ fr_app_worker_t const *app_process;
+ fr_dict_enum_t const *enumv;
+
+ app_process = (fr_app_worker_t const *)inst->type_submodule[i]->module->common;
+ if (app_process->instantiate && (app_process->instantiate(inst->type_submodule[i]->data,
+ inst->type_submodule[i]->conf) < 0)) {
+ cf_log_err(conf, "Instantiation failed for \"%s\"", app_process->name);
+ return -1;
+ }
+
+ /*
+ * We've already done bounds checking in the type_parse function
+ */
+ enumv = cf_data_value(cf_data_find(cp, fr_dict_enum_t, NULL));
+ if (!fr_cond_assert(enumv)) return -1;
+
+ inst->process = app_process->entry_point; /* Store the state function */
+ i++;
+ }
+
+ /*
+ * No IO module, it's an empty listener.
+ */
+ if (!i || !inst->io.submodule) return 0;
+
+ /*
+ * These configuration items are not printed by default,
+ * because normal people shouldn't be touching them.
+ */
+ if (!inst->max_packet_size && inst->io.app_io) inst->max_packet_size = inst->io.app_io->default_message_size;
+
+ if (!inst->num_messages) inst->num_messages = 256;
+
+ FR_INTEGER_BOUND_CHECK("num_messages", inst->num_messages, >=, 32);
+ FR_INTEGER_BOUND_CHECK("num_messages", inst->num_messages, <=, 65535);
+
+ FR_INTEGER_BOUND_CHECK("max_packet_size", inst->max_packet_size, >=, 1024);
+ FR_INTEGER_BOUND_CHECK("max_packet_size", inst->max_packet_size, <=, 65535);
+
+ /*
+ * Set talloc ctx for master IO.
+ */
+ inst->io.ctx = inst;
+
+ /*
+ * Instantiate the master io submodule
+ */
+ if (fr_master_app_io.instantiate(&inst->io, conf) < 0) {
+ return -1;
+
+ }
+
+ /*
+ * No dynamic clients, nothing more to do.
+ */
+ if (!inst->io.dynamic_clients) return 0;
+
+ /*
+ * Instantiate proto_control_dynamic_client
+ */
+ {
+ fr_app_worker_t const *app_process;
+
+ app_process = (fr_app_worker_t const *)inst->dynamic_submodule->module->common;
+ if (app_process->instantiate && (app_process->instantiate(inst->dynamic_submodule->data, conf) < 0)) {
+ cf_log_err(conf, "Instantiation failed for \"%s\"", app_process->name);
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+
+/** Bootstrap the application
+ *
+ * Bootstrap I/O and type submodules.
+ *
+ * @param[in] instance Ctx data for this application.
+ * @param[in] conf Listen section parsed to give us instance.
+ * @return
+ * - 0 on success.
+ * - -1 on failure.
+ */
+static int mod_bootstrap(void *instance, CONF_SECTION *conf)
+{
+ proto_control_t *inst = talloc_get_type_abort(instance, proto_control_t);
+ size_t i = 0;
+ CONF_PAIR *cp = NULL;
+
+ /*
+ * Ensure that the server CONF_SECTION is always set.
+ */
+ inst->io.server_cs = cf_item_to_section(cf_parent(conf));
+
+ /*
+ * Bootstrap the process modules
+ */
+ while ((cp = cf_pair_find_next(conf, cp, "type"))) {
+ char const *value;
+ dl_t const *module = talloc_get_type_abort_const(inst->type_submodule[i]->module, dl_t);
+ fr_app_worker_t const *app_process = (fr_app_worker_t const *)module->common;
+
+ if (app_process->bootstrap && (app_process->bootstrap(inst->type_submodule[i]->data,
+ inst->type_submodule[i]->conf) < 0)) {
+ cf_log_err(conf, "Bootstrap failed for \"%s\"", app_process->name);
+ return -1;
+ }
+
+ value = cf_pair_value(cp);
+
+ /*
+ * Add handlers for the virtual server calls.
+ * This is so that when one virtual server wants
+ * to call another, it just looks up the data
+ * here by packet name, and doesn't need to troll
+ * through all of the listeners.
+ */
+ if (!cf_data_find(inst->io.server_cs, fr_io_process_t, value)) {
+ fr_io_process_t *process_p;
+
+ rad_assert(inst->io.server_cs); /* Ensure we don't leak memory */
+
+ process_p = talloc(inst->io.server_cs, fr_io_process_t);
+ *process_p = app_process->entry_point;
+
+ (void) cf_data_add(inst->io.server_cs, process_p, value, NULL);
+ }
+
+ i++;
+ }
+
+ /*
+ * No IO module, it's an empty listener.
+ */
+ if (!inst->io.submodule) return 0;
+
+ /*
+ * These timers are usually protocol specific.
+ */
+ FR_TIMEVAL_BOUND_CHECK("idle_timeout", &inst->io.idle_timeout, >=, 1, 0);
+ FR_TIMEVAL_BOUND_CHECK("idle_timeout", &inst->io.idle_timeout, <=, 600, 0);
+
+ FR_TIMEVAL_BOUND_CHECK("nak_lifetime", &inst->io.nak_lifetime, >=, 1, 0);
+ FR_TIMEVAL_BOUND_CHECK("nak_lifetime", &inst->io.nak_lifetime, <=, 600, 0);
+
+ /*
+ * Tell the master handler about the main protocol instance.
+ */
+ inst->io.app = &proto_control;
+ inst->io.app_instance = inst;
+
+ /*
+ * We will need this for dynamic clients and connected sockets.
+ */
+ inst->io.dl_inst = dl_instance_find(inst);
+ rad_assert(inst != NULL);
+
+ /*
+ * Bootstrap the master IO handler.
+ */
+ if (fr_master_app_io.bootstrap(&inst->io, conf) < 0) {
+ return -1;
+ }
+
+ /*
+ * proto_control_udp determines if we have dynamic clients
+ * or not.
+ */
+ if (!inst->io.dynamic_clients) return 0;
+
+ /*
+ * Load proto_control_dynamic_client
+ */
+ if (dl_instance(inst, &inst->dynamic_submodule,
+ conf, inst->io.dl_inst, "dynamic_client", DL_TYPE_SUBMODULE) < 0) {
+ cf_log_err(conf, "Failed finding proto_control_dynamic_client");
+ return -1;
+ }
+
+ /*
+ * Don't bootstrap the dynamic submodule. We're
+ * not even sure what that means...
+ */
+
+ return 0;
+}
+
+static int mod_load(void)
+{
+ // load stuff?
+
+ return 0;
+}
+
+static void mod_unload(void)
+{
+ // unload stuff?
+}
+
+fr_app_t proto_control = {
+ .magic = RLM_MODULE_INIT,
+ .name = "control",
+ .config = proto_control_config,
+ .inst_size = sizeof(proto_control_t),
+
+ .load = mod_load,
+ .unload = mod_unload,
+ .bootstrap = mod_bootstrap,
+ .instantiate = mod_instantiate,
+ .open = mod_open,
+ .decode = mod_decode,
+ .encode = mod_encode,
+ .entry_point_set = mod_entry_point_set,
+ .priority = mod_priority_set
+};
--- /dev/null
+#pragma once
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/*
+ * $Id$
+ *
+ * @file proto_control.h
+ * @brief Structures for the CONTROL protocol
+ *
+ * @copyright 2018 Alan DeKok <aland@freeradius.org>
+ */
+#include <freeradius-devel/io/master.h>
+
+/** An instance of a proto_control listen section
+ *
+ */
+typedef struct {
+ fr_io_instance_t io; //!< wrapper for IO abstraction
+
+ dl_instance_t **type_submodule; //!< Instance of the various types
+ dl_instance_t *dynamic_submodule; //!< proto_control_dynamic_client
+ //!< only one instance per type allowed.
+ fr_io_process_t process; //!< process function
+
+ uint32_t max_packet_size; //!< for message ring buffer.
+ uint32_t num_messages; //!< for message ring buffer.
+} proto_control_t;
--- /dev/null
+TARGETNAME := proto_control
+
+ifneq "$(TARGETNAME)" ""
+TARGET := $(TARGETNAME).a
+endif
+
+SOURCES := proto_control.c
+
+TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-util.a libfreeradius-radius.a libfreeradius-io.a
--- /dev/null
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/**
+ * $Id$
+ * @file proto_control_tcp.c
+ * @brief Control handler for TCP.
+ *
+ * @copyright 2016 The FreeRADIUS server project.
+ * @copyright 2016 Alan DeKok (aland@deployingradius.com)
+ */
+#include <netdb.h>
+#include <freeradius-devel/radiusd.h>
+#include <freeradius-devel/protocol.h>
+#include <freeradius-devel/tcp.h>
+#include <freeradius-devel/trie.h>
+#include <freeradius-devel/radius/radius.h>
+#include <freeradius-devel/io/io.h>
+#include <freeradius-devel/io/application.h>
+#include <freeradius-devel/io/listen.h>
+#include <freeradius-devel/io/schedule.h>
+#include <freeradius-devel/rad_assert.h>
+#include "proto_control.h"
+
+typedef struct {
+ char const *name; //!< socket name
+ CONF_SECTION *cs; //!< our configuration
+
+ int sockfd;
+
+ fr_event_list_t *el; //!< for cleanup timers on Access-Request
+ fr_network_t *nr; //!< for fr_network_listen_read();
+
+ fr_ipaddr_t ipaddr; //!< IP address to listen on.
+
+ char const *interface; //!< Interface to bind to.
+ char const *port_name; //!< Name of the port for getservent().
+
+ uint32_t recv_buff; //!< How big the kernel's receive buffer should be.
+
+ uint32_t max_packet_size; //!< for message ring buffer.
+
+ fr_stats_t stats; //!< statistics for this socket
+
+ uint16_t port; //!< Port to listen on.
+
+ bool recv_buff_is_set; //!< Whether we were provided with a receive
+ //!< buffer value.
+ bool dynamic_clients; //!< whether we have dynamic clients
+
+ fr_trie_t *trie; //!< for parsed networks
+ fr_ipaddr_t *allow; //!< allowed networks for dynamic clients
+ fr_ipaddr_t *deny; //!< denied networks for dynamic clients
+
+ fr_io_address_t *connection; //!< for connected sockets.
+
+} proto_control_tcp_t;
+
+
+static const CONF_PARSER networks_config[] = {
+ { FR_CONF_OFFSET("allow", FR_TYPE_COMBO_IP_PREFIX | FR_TYPE_MULTI, proto_control_tcp_t, allow) },
+ { FR_CONF_OFFSET("deny", FR_TYPE_COMBO_IP_PREFIX | FR_TYPE_MULTI, proto_control_tcp_t, deny) },
+
+ CONF_PARSER_TERMINATOR
+};
+
+
+static const CONF_PARSER tcp_listen_config[] = {
+ { FR_CONF_OFFSET("ipaddr", FR_TYPE_COMBO_IP_ADDR, proto_control_tcp_t, ipaddr) },
+ { FR_CONF_OFFSET("ipv4addr", FR_TYPE_IPV4_ADDR, proto_control_tcp_t, ipaddr) },
+ { FR_CONF_OFFSET("ipv6addr", FR_TYPE_IPV6_ADDR, proto_control_tcp_t, ipaddr) },
+
+ { FR_CONF_OFFSET("interface", FR_TYPE_STRING, proto_control_tcp_t, interface) },
+ { FR_CONF_OFFSET("port_name", FR_TYPE_STRING, proto_control_tcp_t, port_name) },
+
+ { FR_CONF_OFFSET("port", FR_TYPE_UINT16, proto_control_tcp_t, port) },
+ { FR_CONF_IS_SET_OFFSET("recv_buff", FR_TYPE_UINT32, proto_control_tcp_t, recv_buff) },
+
+ { FR_CONF_OFFSET("dynamic_clients", FR_TYPE_BOOL, proto_control_tcp_t, dynamic_clients) } ,
+ { FR_CONF_POINTER("networks", FR_TYPE_SUBSECTION, NULL), .subcs = (void const *) networks_config },
+
+ { FR_CONF_OFFSET("max_packet_size", FR_TYPE_UINT32, proto_control_tcp_t, max_packet_size), .dflt = "4096" } ,
+
+ CONF_PARSER_TERMINATOR
+};
+
+
+static ssize_t mod_read(void *instance, UNUSED void **packet_ctx, fr_time_t **recv_time, uint8_t *buffer, size_t buffer_len, size_t *leftover, UNUSED uint32_t *priority, UNUSED bool *is_dup)
+{
+ proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t);
+ ssize_t data_size;
+ size_t packet_len = -1;
+
+ fr_time_t *recv_time_p;
+
+ recv_time_p = *recv_time;
+
+ /*
+ * Read data into the buffer.
+ */
+ data_size = read(inst->sockfd, buffer + *leftover, buffer_len - *leftover);
+ if (data_size < 0) {
+ DEBUG2("proto_control_tcp got read error %zd: %s", data_size, fr_strerror());
+ return data_size;
+ }
+
+ /*
+ * Note that we return ERROR for all bad packets, as
+ * there's no point in reading packets from a TCP
+ * connection which isn't sending us properly formatted
+ * packets.
+ */
+
+ /*
+ * TCP read of zero means the socket is dead.
+ */
+ if (!data_size) {
+ DEBUG2("proto_control_tcp - other side closed the socket.");
+ return -1;
+ }
+
+ // @todo - check authentication, etc. on the socket.
+ // we will need a state machine for this..
+
+ /*
+ * Not enough for one packet. Tell the caller that we need to read more.
+ */
+ if (data_size < 20) {
+ *leftover = data_size;
+ return 0;
+ }
+
+#if 0
+ /*
+ * If it's not a RADIUS packet, ignore it.
+ */
+ if (!fr_radius_ok(buffer, &packet_len, inst->max_attributes, false, &reason)) {
+ /*
+ * @todo - check for F5 load balancer packets. <sigh>
+ */
+ DEBUG2("proto_control_tcp got a packet which isn't RADIUS");
+ inst->stats.total_malformed_requests++;
+ return -1;
+ }
+#endif
+
+ // @todo - maybe convert timestamp?
+ *recv_time_p = fr_time();
+
+ /*
+ * proto_control sets the priority
+ */
+
+ /*
+ * Print out what we received.
+ */
+ DEBUG2("proto_control_tcp - Received %s ID %d length %d %s",
+ fr_packet_codes[buffer[0]], buffer[1],
+ (int) packet_len, inst->name);
+
+ return packet_len;
+}
+
+
+static ssize_t mod_write(void *instance, void *packet_ctx,
+ UNUSED fr_time_t request_time, uint8_t *buffer, size_t buffer_len)
+{
+ proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t);
+ fr_io_track_t *track = talloc_get_type_abort(packet_ctx, fr_io_track_t);
+ ssize_t data_size;
+
+ /*
+ * @todo - share a stats interface with the parent? or
+ * put the stats in the listener, so that proto_control
+ * can update them, too.. <sigh>
+ */
+ inst->stats.total_responses++;
+
+ /*
+ * This handles the race condition where we get a DUP,
+ * but the original packet replies before we're run.
+ * i.e. this packet isn't marked DUP, so we have to
+ * discover it's a dup later...
+ *
+ * As such, if there's already a reply, then we ignore
+ * the encoded reply (which is probably going to be a
+ * NAK), and instead just ignore the DUP and don't reply.
+ */
+ if (track->reply_len) {
+ return buffer_len;
+ }
+
+ /*
+ * We only write RADIUS packets.
+ */
+ rad_assert(buffer_len >= 20);
+
+ /*
+ * Only write replies if they're RADIUS packets.
+ * sometimes we want to NOT send a reply...
+ */
+ data_size = write(inst->sockfd, buffer, buffer_len);
+
+ // @todo - catch EWOULDBLOCK
+ // @todo - catch partial writes
+
+ /*
+ * This socket is dead. That's an error...
+ */
+ if (data_size <= 0) return data_size;
+
+ /*
+ * Root through the reply to determine any
+ * connection-level negotiation data.
+ */
+ if (track->packet[0] == FR_CODE_STATUS_SERVER) {
+// status_check_reply(inst, buffer, buffer_len);
+ }
+
+ return data_size;
+}
+
+
+/** Close a TCP listener for RADIUS
+ *
+ * @param[in] instance of the RADIUS TCP I/O path.
+ * @return
+ * - <0 on error
+ * - 0 on success
+ */
+static int mod_close(void *instance)
+{
+ proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t);
+
+ close(inst->sockfd);
+ inst->sockfd = -1;
+
+ return 0;
+}
+
+static int mod_connection_set(void *instance, fr_io_address_t *connection)
+{
+ proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t);
+
+ inst->connection = connection;
+ return 0;
+}
+
+
+static void mod_network_get(void *instance, int *ipproto, bool *dynamic_clients, fr_trie_t const **trie)
+{
+ proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t);
+
+ *ipproto = IPPROTO_TCP;
+ *dynamic_clients = inst->dynamic_clients;
+ *trie = inst->trie;
+}
+
+
+/** Open a TCP listener for RADIUS
+ *
+ * @param[in] instance of the RADIUS TCP I/O path.
+ * @return
+ * - <0 on error
+ * - 0 on success
+ */
+static int mod_open(void *instance)
+{
+ proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t);
+
+ int sockfd = 0;
+ uint16_t port = inst->port;
+ CONF_SECTION *server_cs;
+ CONF_ITEM *ci;
+
+ rad_assert(!inst->connection);
+
+ sockfd = fr_socket_server_tcp(&inst->ipaddr, &port, inst->port_name, true);
+ if (sockfd < 0) {
+ PERROR("Failed opening TCP socket");
+ error:
+ return -1;
+ }
+
+ if (fr_socket_bind(sockfd, &inst->ipaddr, &port, inst->interface) < 0) {
+ close(sockfd);
+ PERROR("Failed binding socket");
+ goto error;
+ }
+
+ if (listen(sockfd, 8) < 0) {
+ close(sockfd);
+ PERROR("Failed listening on socket");
+ goto error;
+ }
+
+ inst->sockfd = sockfd;
+
+ ci = cf_parent(inst->cs); /* listen { ... } */
+ rad_assert(ci != NULL);
+ ci = cf_parent(ci);
+ rad_assert(ci != NULL);
+
+ server_cs = cf_item_to_section(ci);
+
+ // @todo - also print out auth / acct / coa, etc.
+ DEBUG("Listening on control address %s bound to virtual server %s",
+ inst->name, cf_section_name2(server_cs));
+
+ return 0;
+}
+
+/** Get the file descriptor for this socket.
+ *
+ * @param[in] instance of the RADIUS TCP I/O path.
+ * @return the file descriptor
+ */
+static int mod_fd(void const *instance)
+{
+ proto_control_tcp_t const *inst = talloc_get_type_abort_const(instance, proto_control_tcp_t);
+
+ return inst->sockfd;
+}
+
+/** Set the file descriptor for this socket.
+ *
+ * @param[in] instance of the RADIUS TCP I/O path.
+ * @param[in] fd the FD to set
+ */
+static void mod_fd_set(void *instance, int fd)
+{
+ proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t);
+
+ inst->sockfd = fd;
+}
+
+static int mod_instantiate(void *instance, UNUSED CONF_SECTION *cs)
+{
+ proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t);
+ char dst_buf[128];
+
+ /*
+ * Get our name.
+ */
+ if (fr_ipaddr_is_inaddr_any(&inst->ipaddr)) {
+ if (inst->ipaddr.af == AF_INET) {
+ strlcpy(dst_buf, "*", sizeof(dst_buf));
+ } else {
+ rad_assert(inst->ipaddr.af == AF_INET6);
+ strlcpy(dst_buf, "::", sizeof(dst_buf));
+ }
+ } else {
+ fr_value_box_snprint(dst_buf, sizeof(dst_buf), fr_box_ipaddr(inst->ipaddr), 0);
+ }
+
+ if (!inst->connection) {
+ inst->name = talloc_typed_asprintf(inst, "proto tcp server %s port %u",
+ dst_buf, inst->port);
+
+ } else {
+ char src_buf[128];
+
+ fr_value_box_snprint(src_buf, sizeof(src_buf), fr_box_ipaddr(inst->connection->src_ipaddr), 0);
+
+ inst->name = talloc_typed_asprintf(inst, "proto tcp from client %s port %u to server %s port %u",
+ src_buf, inst->connection->src_port, dst_buf, inst->port);
+ }
+
+ return 0;
+}
+
+
+static int mod_bootstrap(void *instance, CONF_SECTION *cs)
+{
+ proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t);
+ size_t i, num;
+
+ inst->cs = cs;
+
+ /*
+ * Complain if no "ipaddr" is set.
+ */
+ if (inst->ipaddr.af == AF_UNSPEC) {
+ cf_log_err(cs, "No 'ipaddr' was specified in the 'tcp' section");
+ return -1;
+ }
+
+ if (inst->recv_buff_is_set) {
+ FR_INTEGER_BOUND_CHECK("recv_buff", inst->recv_buff, >=, 32);
+ FR_INTEGER_BOUND_CHECK("recv_buff", inst->recv_buff, <=, INT_MAX);
+ }
+
+ FR_INTEGER_BOUND_CHECK("max_packet_size", inst->max_packet_size, >=, 20);
+ FR_INTEGER_BOUND_CHECK("max_packet_size", inst->max_packet_size, <=, 65536);
+
+ if (!inst->port) {
+ struct servent *s;
+
+ if (!inst->port_name) {
+ cf_log_err(cs, "No 'port' was specified in the 'tcp' section");
+ return -1;
+ }
+
+ s = getservbyname(inst->port_name, "tcp");
+ if (!s) {
+ cf_log_err(cs, "Unknown value for 'port_name = %s", inst->port_name);
+ return -1;
+ }
+
+ inst->port = ntohl(s->s_port);
+ }
+
+ /*
+ * Parse and create the trie for dynamic clients, even if
+ * there's no dynamic clients.
+ *
+ * @todo - we could use this for source IP filtering?
+ * e.g. allow clients from a /16, but not from a /24
+ * within that /16.
+ */
+ num = talloc_array_length(inst->allow);
+ if (!num) {
+ if (inst->dynamic_clients) {
+ cf_log_err(cs, "The 'allow' subsection MUST contain at least one 'network' entry when 'dynamic_clients = true'.");
+ return -1;
+ }
+ } else {
+ MEM(inst->trie = fr_trie_alloc(inst));
+
+ for (i = 0; i < num; i++) {
+ fr_ipaddr_t *network;
+ char buffer[256];
+
+ /*
+ * Can't add v4 networks to a v6 socket, or vice versa.
+ */
+ if (inst->allow[i].af != inst->ipaddr.af) {
+ fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->allow[i]), 0);
+ cf_log_err(cs, "Address family in entry %zd - 'allow = %s' does not match 'ipaddr'", i + 1, buffer);
+ return -1;
+ }
+
+ /*
+ * Duplicates are bad.
+ */
+ network = fr_trie_match(inst->trie,
+ &inst->allow[i].addr, inst->allow[i].prefix);
+ if (network) {
+ fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->allow[i]), 0);
+ cf_log_err(cs, "Cannot add duplicate entry 'allow = %s'", buffer);
+ return -1;
+ }
+
+ /*
+ * Look for overlapping entries.
+ * i.e. the networks MUST be disjoint.
+ *
+ * Note that this catches 192.168.1/24
+ * followed by 192.168/16, but NOT the
+ * other way around. The best fix is
+ * likely to add a flag to
+ * fr_trie_alloc() saying "we can only
+ * have terminal fr_trie_user_t nodes"
+ */
+ network = fr_trie_lookup(inst->trie,
+ &inst->allow[i].addr, inst->allow[i].prefix);
+ if (network && (network->prefix <= inst->allow[i].prefix)) {
+ fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->allow[i]), 0);
+ cf_log_err(cs, "Cannot add overlapping entry 'allow = %s'", buffer);
+ cf_log_err(cs, "Entry is completely enclosed inside of a previously defined network.");
+ return -1;
+ }
+
+ /*
+ * Insert the network into the trie.
+ * Lookups will return the fr_ipaddr_t of
+ * the network.
+ */
+ if (fr_trie_insert(inst->trie,
+ &inst->allow[i].addr, inst->allow[i].prefix,
+ &inst->allow[i]) < 0) {
+ fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->allow[i]), 0);
+ cf_log_err(cs, "Failed adding 'allow = %s' to tracking table.", buffer);
+ return -1;
+ }
+ }
+
+ /*
+ * And now check denied networks.
+ */
+ num = talloc_array_length(inst->deny);
+ if (!num) return 0;
+
+ /*
+ * Since the default is to deny, you can only add
+ * a "deny" inside of a previous "allow".
+ */
+ for (i = 0; i < num; i++) {
+ fr_ipaddr_t *network;
+ char buffer[256];
+
+ /*
+ * Can't add v4 networks to a v6 socket, or vice versa.
+ */
+ if (inst->deny[i].af != inst->ipaddr.af) {
+ fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->deny[i]), 0);
+ cf_log_err(cs, "Address family in entry %zd - 'deny = %s' does not match 'ipaddr'", i + 1, buffer);
+ return -1;
+ }
+
+ /*
+ * Duplicates are bad.
+ */
+ network = fr_trie_match(inst->trie,
+ &inst->deny[i].addr, inst->deny[i].prefix);
+ if (network) {
+ fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->deny[i]), 0);
+ cf_log_err(cs, "Cannot add duplicate entry 'deny = %s'", buffer);
+ return -1;
+ }
+
+ /*
+ * A "deny" can only be within a previous "allow".
+ */
+ network = fr_trie_lookup(inst->trie,
+ &inst->deny[i].addr, inst->deny[i].prefix);
+ if (!network) {
+ fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->deny[i]), 0);
+ cf_log_err(cs, "The network in entry %zd - 'deny = %s' is not contained within a previous 'allow'",
+ i + 1, buffer);
+ return -1;
+ }
+
+ /*
+ * We hack the AF in "deny" rules. If
+ * the lookup gets AF_UNSPEC, then we're
+ * adding a "deny" inside of a "deny".
+ */
+ if (network->af != inst->ipaddr.af) {
+ fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->deny[i]), 0);
+ cf_log_err(cs, "The network in entry %zd - 'deny = %s' is overlaps with another 'deny' rule",
+ i + 1, buffer);
+ return -1;
+ }
+
+ /*
+ * Insert the network into the trie.
+ * Lookups will return the fr_ipaddr_t of
+ * the network.
+ */
+ if (fr_trie_insert(inst->trie,
+ &inst->deny[i].addr, inst->deny[i].prefix,
+ &inst->deny[i]) < 0) {
+ fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->deny[i]), 0);
+ cf_log_err(cs, "Failed adding 'deny = %s' to tracking table.", buffer);
+ return -1;
+ }
+
+ /*
+ * Hack it to make it a deny rule.
+ */
+ inst->deny[i].af = AF_UNSPEC;
+ }
+ }
+
+ return 0;
+}
+
+static RADCLIENT *mod_client_find(UNUSED void *instance, fr_ipaddr_t const *ipaddr, int ipproto)
+{
+ return client_find(NULL, ipaddr, ipproto);
+}
+
+#if 0
+static int mod_detach(void *instance)
+{
+ proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t);
+
+ if (inst->sockfd >= 0) close(inst->sockfd);
+ inst->sockfd = -1;
+
+ return 0;
+}
+#endif
+
+extern fr_app_io_t proto_control_tcp;
+fr_app_io_t proto_control_tcp = {
+ .magic = RLM_MODULE_INIT,
+ .name = "control_tcp",
+ .config = tcp_listen_config,
+ .inst_size = sizeof(proto_control_tcp_t),
+// .detach = mod_detach,
+ .bootstrap = mod_bootstrap,
+ .instantiate = mod_instantiate,
+
+ .default_message_size = 4096,
+
+ .open = mod_open,
+ .read = mod_read,
+ .write = mod_write,
+ .close = mod_close,
+ .fd = mod_fd,
+ .fd_set = mod_fd_set,
+ .connection_set = mod_connection_set,
+ .network_get = mod_network_get,
+ .client_find = mod_client_find,
+};
--- /dev/null
+TARGETNAME := proto_control_tcp
+
+ifneq "$(TARGETNAME)" ""
+TARGET := $(TARGETNAME).a
+endif
+
+SOURCES := proto_control_tcp.c
+
+TGT_PREREQS := libfreeradius-util.a
--- /dev/null
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/**
+ * $Id$
+ * @file proto_control_unix.c
+ * @brief Control handler for Unix sockets.
+ *
+ * @copyright 2016 The FreeRADIUS server project.
+ * @copyright 2016 Alan DeKok (aland@deployingradius.com)
+ */
+#include <netdb.h>
+#include <freeradius-devel/radiusd.h>
+#include <freeradius-devel/protocol.h>
+#include <freeradius-devel/trie.h>
+#include <freeradius-devel/radius/radius.h>
+#include <freeradius-devel/io/io.h>
+#include <freeradius-devel/io/application.h>
+#include <freeradius-devel/io/listen.h>
+#include <freeradius-devel/io/schedule.h>
+#include <freeradius-devel/rad_assert.h>
+#include "proto_control.h"
+
+typedef struct {
+ char const *name; //!< socket name
+ CONF_SECTION *cs; //!< our configuration
+
+ int sockfd;
+
+ fr_event_list_t *el; //!< for cleanup timers on Access-Request
+ fr_network_t *nr; //!< for fr_network_listen_read();
+
+ char const *path; //!< path to socket name
+
+ uint32_t recv_buff; //!< How big the kernel's receive buffer should be.
+
+ uint32_t max_packet_size; //!< for message ring buffer.
+
+ fr_stats_t stats; //!< statistics for this socket
+
+ bool recv_buff_is_set; //!< Whether we were provided with a receive
+ //!< buffer value.
+
+ fr_io_address_t *connection; //!< for connected sockets.
+
+} proto_control_unix_t;
+
+static const CONF_PARSER unix_listen_config[] = {
+ { FR_CONF_OFFSET("path", FR_TYPE_STRING, proto_control_unix_t, path) },
+ { FR_CONF_IS_SET_OFFSET("recv_buff", FR_TYPE_UINT32, proto_control_unix_t, recv_buff) },
+
+ { FR_CONF_OFFSET("max_packet_size", FR_TYPE_UINT32, proto_control_unix_t, max_packet_size), .dflt = "4096" } ,
+
+ CONF_PARSER_TERMINATOR
+};
+
+
+static ssize_t mod_read(void *instance, UNUSED void **packet_ctx, fr_time_t **recv_time, uint8_t *buffer, size_t buffer_len, size_t *leftover, UNUSED uint32_t *priority, UNUSED bool *is_dup)
+{
+ proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t);
+ ssize_t data_size;
+ size_t packet_len = -1;
+
+ fr_time_t *recv_time_p;
+
+ recv_time_p = *recv_time;
+
+ /*
+ * Read data into the buffer.
+ */
+ data_size = read(inst->sockfd, buffer + *leftover, buffer_len - *leftover);
+ if (data_size < 0) {
+ DEBUG2("proto_control_unix got read error %zd: %s", data_size, fr_strerror());
+ return data_size;
+ }
+
+ /*
+ * Note that we return ERROR for all bad packets, as
+ * there's no point in reading packets from a UNIX
+ * connection which isn't sending us properly formatted
+ * packets.
+ */
+
+ /*
+ * UNIX read of zero means the socket is dead.
+ */
+ if (!data_size) {
+ DEBUG2("proto_control_unix - other side closed the socket.");
+ return -1;
+ }
+
+ // @todo - check authentication, etc. on the socket.
+ // we will need a state machine for this..
+
+ /*
+ * Not enough for one packet. Tell the caller that we need to read more.
+ */
+ if (data_size < 20) {
+ *leftover = data_size;
+ return 0;
+ }
+
+#if 0
+ /*
+ * If it's not a RADIUS packet, ignore it.
+ */
+ if (!fr_radius_ok(buffer, &packet_len, inst->max_attributes, false, &reason)) {
+ /*
+ * @todo - check for F5 load balancer packets. <sigh>
+ */
+ DEBUG2("proto_control_unix got a packet which isn't RADIUS");
+ inst->stats.total_malformed_requests++;
+ return -1;
+ }
+#endif
+
+ // @todo - maybe convert timestamp?
+ *recv_time_p = fr_time();
+
+ /*
+ * proto_control sets the priority
+ */
+
+ /*
+ * Print out what we received.
+ */
+ DEBUG2("proto_control_unix - Received %s ID %d length %d %s",
+ fr_packet_codes[buffer[0]], buffer[1],
+ (int) packet_len, inst->name);
+
+ return packet_len;
+}
+
+
+static ssize_t mod_write(void *instance, void *packet_ctx,
+ UNUSED fr_time_t request_time, uint8_t *buffer, size_t buffer_len)
+{
+ proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t);
+ fr_io_track_t *track = talloc_get_type_abort(packet_ctx, fr_io_track_t);
+ ssize_t data_size;
+
+ /*
+ * @todo - share a stats interface with the parent? or
+ * put the stats in the listener, so that proto_control
+ * can update them, too.. <sigh>
+ */
+ inst->stats.total_responses++;
+
+ /*
+ * This handles the race condition where we get a DUP,
+ * but the original packet replies before we're run.
+ * i.e. this packet isn't marked DUP, so we have to
+ * discover it's a dup later...
+ *
+ * As such, if there's already a reply, then we ignore
+ * the encoded reply (which is probably going to be a
+ * NAK), and instead just ignore the DUP and don't reply.
+ */
+ if (track->reply_len) {
+ return buffer_len;
+ }
+
+ /*
+ * We only write RADIUS packets.
+ */
+ rad_assert(buffer_len >= 20);
+
+ /*
+ * Only write replies if they're RADIUS packets.
+ * sometimes we want to NOT send a reply...
+ */
+ data_size = write(inst->sockfd, buffer, buffer_len);
+
+ // @todo - catch EWOULDBLOCK
+ // @todo - catch partial writes
+
+ /*
+ * This socket is dead. That's an error...
+ */
+ if (data_size <= 0) return data_size;
+
+ /*
+ * Root through the reply to determine any
+ * connection-level negotiation data.
+ */
+ if (track->packet[0] == FR_CODE_STATUS_SERVER) {
+// status_check_reply(inst, buffer, buffer_len);
+ }
+
+ return data_size;
+}
+
+
+/** Close a UNIX listener for RADIUS
+ *
+ * @param[in] instance of the RADIUS UNIX I/O path.
+ * @return
+ * - <0 on error
+ * - 0 on success
+ */
+static int mod_close(void *instance)
+{
+ proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t);
+
+ close(inst->sockfd);
+ inst->sockfd = -1;
+
+ return 0;
+}
+
+static int mod_connection_set(void *instance, fr_io_address_t *connection)
+{
+ proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t);
+
+ inst->connection = connection;
+ return 0;
+}
+
+
+/** Open a UNIX listener for RADIUS
+ *
+ * @param[in] instance of the RADIUS UNIX I/O path.
+ * @return
+ * - <0 on error
+ * - 0 on success
+ */
+static int mod_open(void *instance)
+{
+ proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t);
+
+ int sockfd = 0;
+ CONF_SECTION *server_cs;
+ CONF_ITEM *ci;
+
+ rad_assert(!inst->connection);
+
+#if 0
+ // @todo - open / create the Unix socket
+ sockfd = fr_socket_server_unix(&inst->ipaddr, &port, inst->port_name, true);
+#else
+ sockfd = -1;
+#endif
+ if (sockfd < 0) {
+ PERROR("Failed opening UNIX socket");
+ error:
+ return -1;
+ }
+
+ if (listen(sockfd, 8) < 0) {
+ close(sockfd);
+ PERROR("Failed listening on socket");
+ goto error;
+ }
+
+ inst->sockfd = sockfd;
+
+ ci = cf_parent(inst->cs); /* listen { ... } */
+ rad_assert(ci != NULL);
+ ci = cf_parent(ci);
+ rad_assert(ci != NULL);
+
+ server_cs = cf_item_to_section(ci);
+
+ // @todo - also print out auth / acct / coa, etc.
+ DEBUG("Listening on control address %s bound to virtual server %s",
+ inst->name, cf_section_name2(server_cs));
+
+ return 0;
+}
+
+/** Get the file descriptor for this socket.
+ *
+ * @param[in] instance of the RADIUS UNIX I/O path.
+ * @return the file descriptor
+ */
+static int mod_fd(void const *instance)
+{
+ proto_control_unix_t const *inst = talloc_get_type_abort_const(instance, proto_control_unix_t);
+
+ return inst->sockfd;
+}
+
+/** Set the file descriptor for this socket.
+ *
+ * @param[in] instance of the RADIUS UNIX I/O path.
+ * @param[in] fd the FD to set
+ */
+static void mod_fd_set(void *instance, int fd)
+{
+ proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t);
+
+ inst->sockfd = fd;
+}
+
+
+static int mod_instantiate(void *instance, UNUSED CONF_SECTION *cs)
+{
+ proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t);
+ char dst_buf[128];
+
+ if (!inst->connection) {
+ inst->name = talloc_typed_asprintf(inst, "proto unix server %s path %s",
+ dst_buf, inst->path);
+
+ } else {
+ inst->name = talloc_typed_asprintf(inst, "proto unix from client ??? to server path %s",
+ inst->path);
+ }
+
+ return 0;
+}
+
+
+static int mod_bootstrap(void *instance, CONF_SECTION *cs)
+{
+ proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t);
+
+ inst->cs = cs;
+
+ if (inst->recv_buff_is_set) {
+ FR_INTEGER_BOUND_CHECK("recv_buff", inst->recv_buff, >=, 32);
+ FR_INTEGER_BOUND_CHECK("recv_buff", inst->recv_buff, <=, INT_MAX);
+ }
+
+ FR_INTEGER_BOUND_CHECK("max_packet_size", inst->max_packet_size, >=, 20);
+ FR_INTEGER_BOUND_CHECK("max_packet_size", inst->max_packet_size, <=, 65536);
+
+ return 0;
+}
+
+static RADCLIENT *mod_client_find(UNUSED void *instance, fr_ipaddr_t const *ipaddr, int ipproto)
+{
+ // @todo - stream sockets?
+ return client_find(NULL, ipaddr, ipproto);
+}
+
+#if 0
+static int mod_detach(void *instance)
+{
+ proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t);
+
+ if (inst->sockfd >= 0) close(inst->sockfd);
+ inst->sockfd = -1;
+
+ return 0;
+}
+#endif
+
+extern fr_app_io_t proto_control_unix;
+fr_app_io_t proto_control_unix = {
+ .magic = RLM_MODULE_INIT,
+ .name = "control_unix",
+ .config = unix_listen_config,
+ .inst_size = sizeof(proto_control_unix_t),
+// .detach = mod_detach,
+ .bootstrap = mod_bootstrap,
+ .instantiate = mod_instantiate,
+
+ .default_message_size = 4096,
+ .track_duplicates = true,
+
+ .open = mod_open,
+ .read = mod_read,
+ .write = mod_write,
+ .close = mod_close,
+ .fd = mod_fd,
+ .fd_set = mod_fd_set,
+ .connection_set = mod_connection_set,
+ .client_find = mod_client_find,
+};
--- /dev/null
+TARGETNAME := proto_control_unix
+
+ifneq "$(TARGETNAME)" ""
+TARGET := $(TARGETNAME).a
+endif
+
+SOURCES := proto_control_unix.c
+
+TGT_PREREQS := libfreeradius-util.a
#include <freeradius-devel/radiusd.h>
#include <freeradius-devel/md5.h>
-#include <freeradius-devel/conduit.h>
#include <freeradius-devel/cf_parse.h>
+#include "conduit.h"
/*
* For configuration file stuff.
TARGET := $(TARGETNAME)
endif
-SOURCES := radmin.c conduit.c
+SOURCES := radmin.c
TGT_INSTALLDIR := ${sbindir}
-TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-util.a
+TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-util.a libfreeradius-control.a
TGT_LDLIBS := $(LIBS) $(LIBREADLINE)
projects / thirdparty / freeradius-server.git / commitdiff
