From: Alan T. DeKok Date: Fri, 1 Jun 2018 16:44:08 +0000 (-0400) Subject: start of proto_control X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=919954e69d6bf539b19c0312e1e111f99b442a56;p=thirdparty%2Ffreeradius-server.git start of proto_control and move radmin to proto_control directory. It's no longer part of the server core. --- diff --git a/src/main/all.mk b/src/main/all.mk index f8e1b90d9c9..925fd75c6fd 100644 --- a/src/main/all.mk +++ b/src/main/all.mk @@ -3,7 +3,6 @@ SUBMAKEFILES := \ radict.mk \ radiusd.mk \ radsniff.mk \ - radmin.mk \ radwho.mk \ radsnmp.mk \ radlast.mk \ diff --git a/src/main/radiusd.mk b/src/main/radiusd.mk index 5887fcded5a..ab00fdc8145 100644 --- a/src/main/radiusd.mk +++ b/src/main/radiusd.mk @@ -1,7 +1,6 @@ TARGET := radiusd SOURCES := \ auth.c \ - conduit.c \ client.c \ crypt.c \ users_file.c \ diff --git a/src/modules/proto_control/all.mk b/src/modules/proto_control/all.mk new file mode 100644 index 00000000000..66e54a4853e --- /dev/null +++ b/src/modules/proto_control/all.mk @@ -0,0 +1 @@ +SUBMAKEFILES := proto_control.mk proto_control_tcp.mk proto_control_unix.mk libfreeradius-control.mk radmin.mk diff --git a/src/main/conduit.c b/src/modules/proto_control/conduit.c similarity index 99% rename from src/main/conduit.c rename to src/modules/proto_control/conduit.c index e80466dd8f2..c4f6b7708ff 100644 --- a/src/main/conduit.c +++ b/src/modules/proto_control/conduit.c @@ -26,7 +26,7 @@ RCSID("$Id$") #include -#include +#include "conduit.h" typedef struct rconduit_t { uint32_t conduit; diff --git a/src/include/conduit.h b/src/modules/proto_control/conduit.h similarity index 100% rename from src/include/conduit.h rename to src/modules/proto_control/conduit.h diff --git a/src/modules/proto_control/libfreeradius-control.mk b/src/modules/proto_control/libfreeradius-control.mk new file mode 100644 index 00000000000..e1aebba60b5 --- /dev/null +++ b/src/modules/proto_control/libfreeradius-control.mk @@ -0,0 +1,5 @@ +TARGET := libfreeradius-control.a + +SOURCES := conduit.c + +SRC_CFLAGS := diff --git a/src/modules/proto_control/proto_control.c b/src/modules/proto_control/proto_control.c new file mode 100644 index 00000000000..847173d4a30 --- /dev/null +++ b/src/modules/proto_control/proto_control.c @@ -0,0 +1,730 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/** + * $Id$ + * @file proto_control.c + * @brief CONTROL master protocol handler. + * + * @copyright 2018 Alan DeKok (aland@freeradius.org) + */ +#include +#include +#include +#include +#include +#include +#include "proto_control.h" + +extern fr_app_t proto_control; +static int type_parse(TALLOC_CTX *ctx, void *out, CONF_ITEM *ci, CONF_PARSER const *rule); +static int transport_parse(TALLOC_CTX *ctx, void *out, CONF_ITEM *ci, CONF_PARSER const *rule); + +static CONF_PARSER const limit_config[] = { + { FR_CONF_OFFSET("idle_timeout", FR_TYPE_TIMEVAL, proto_control_t, io.idle_timeout), .dflt = "30.0" } , + { FR_CONF_OFFSET("nak_lifetime", FR_TYPE_TIMEVAL, proto_control_t, io.nak_lifetime), .dflt = "30.0" } , + + { FR_CONF_OFFSET("max_connections", FR_TYPE_UINT32, proto_control_t, io.max_connections), .dflt = "1024" } , + { FR_CONF_OFFSET("max_clients", FR_TYPE_UINT32, proto_control_t, io.max_clients), .dflt = "256" } , + { FR_CONF_OFFSET("max_pending_packets", FR_TYPE_UINT32, proto_control_t, io.max_pending_packets), .dflt = "256" } , + + /* + * For performance tweaking. NOT for normal humans. + */ + { FR_CONF_OFFSET("max_packet_size", FR_TYPE_UINT32, proto_control_t, max_packet_size) } , + { FR_CONF_OFFSET("num_messages", FR_TYPE_UINT32, proto_control_t, num_messages) } , + + CONF_PARSER_TERMINATOR +}; + +/** How to parse a CONTROL listen section + * + */ +static CONF_PARSER const proto_control_config[] = { + { FR_CONF_OFFSET("type", FR_TYPE_VOID | FR_TYPE_MULTI | FR_TYPE_NOT_EMPTY, proto_control_t, + type_submodule), .func = type_parse }, + { FR_CONF_OFFSET("transport", FR_TYPE_VOID, proto_control_t, io.submodule), + .func = transport_parse }, + + { FR_CONF_POINTER("limit", FR_TYPE_SUBSECTION, NULL), .subcs = (void const *) limit_config }, + CONF_PARSER_TERMINATOR +}; + +static fr_dict_t *dict_control; + +extern fr_dict_autoload_t proto_control_dict[]; +fr_dict_autoload_t proto_control_dict[] = { + { .out = &dict_control, .proto = "internal" }, + { NULL } +}; + +#if 0 +static fr_dict_attr_t const *attr_control_packet_type; + +extern fr_dict_attr_autoload_t proto_control_dict_attr[]; +fr_dict_attr_autoload_t proto_control_dict_attr[] = { + { .out = &attr_control_packet_type, .name = "CONTROL-Packet-Type", .type = FR_TYPE_UINT32, .dict = &dict_control}, + { NULL } +}; +#endif + +/** Wrapper around dl_instance which translates the packet-type into a submodule name + * + * @param[in] ctx to allocate data in (instance of proto_control). + * @param[out] out Where to write a dl_instance_t containing the module handle and instance. + * @param[in] ci #CONF_PAIR specifying the name of the type module. + * @param[in] rule unused. + * @return + * - 0 on success. + * - -1 on failure. + */ +static int type_parse(TALLOC_CTX *ctx, void *out, CONF_ITEM *ci, UNUSED CONF_PARSER const *rule) +{ +// char const *type_str = cf_pair_value(cf_item_to_pair(ci)); + CONF_SECTION *listen_cs = cf_item_to_section(cf_parent(ci)); +// CONF_SECTION *server = cf_item_to_section(cf_parent(listen_cs)); +// proto_control_t *inst; + dl_instance_t *parent_inst; +// fr_dict_enum_t const *type_enum; + + rad_assert(listen_cs && (strcmp(cf_section_name1(listen_cs), "listen") == 0)); + /* + * Parent dl_instance_t added in virtual_servers.c (listen_parse) + * + * We just load proto_control_all.a + * + * Future changes may allow different types of control access? + */ + return dl_instance(ctx, out, listen_cs, parent_inst, "all", DL_TYPE_SUBMODULE); +} + +/** Wrapper around dl_instance + * + * @param[in] ctx to allocate data in (instance of proto_control). + * @param[out] out Where to write a dl_instance_t containing the module handle and instance. + * @param[in] ci #CONF_PAIR specifying the name of the type module. + * @param[in] rule unused. + * @return + * - 0 on success. + * - -1 on failure. + */ +static int transport_parse(TALLOC_CTX *ctx, void *out, CONF_ITEM *ci, UNUSED CONF_PARSER const *rule) +{ + char const *name = cf_pair_value(cf_item_to_pair(ci)); + dl_instance_t *parent_inst; + proto_control_t *inst; + CONF_SECTION *listen_cs = cf_item_to_section(cf_parent(ci)); + CONF_SECTION *transport_cs; + + transport_cs = cf_section_find(listen_cs, name, NULL); + + /* + * Allocate an empty section if one doesn't exist + * this is so defaults get parsed. + */ + if (!transport_cs) transport_cs = cf_section_alloc(listen_cs, listen_cs, name, NULL); + + parent_inst = cf_data_value(cf_data_find(listen_cs, dl_instance_t, "proto_control")); + rad_assert(parent_inst); + + /* + * Set the allowed codes so that we can compile them as + * necessary. + */ + inst = talloc_get_type_abort(parent_inst->data, proto_control_t); + inst->io.transport = name; + + return dl_instance(ctx, out, transport_cs, parent_inst, name, DL_TYPE_SUBMODULE); +} + +/** Decode the packet + * + */ +static int mod_decode(void const *instance, REQUEST *request, uint8_t *const data, size_t data_len) +{ + proto_control_t const *inst = talloc_get_type_abort_const(instance, proto_control_t); + fr_io_track_t const *track = talloc_get_type_abort_const(request->async->packet_ctx, fr_io_track_t); + fr_io_address_t *address = track->address; + RADCLIENT const *client; + + rad_assert(data[0] < FR_MAX_PACKET_CODE); + + /* + * Set the request dictionary so that we can do + * generic->protocol attribute conversions as + * the request runs through the server. + */ + request->dict = dict_control; + + client = address->radclient; + + /* + * Hacks for now until we have a lower-level decode routine. + */ + request->packet->code = data[0]; + request->packet->id = data[1]; + request->reply->id = data[1]; + memcpy(request->packet->vector, data + 4, sizeof(request->packet->vector)); + + request->packet->data = talloc_memdup(request->packet, data, data_len); + request->packet->data_len = data_len; + + /* + * Note that we don't set a limit on max_attributes here. + * That MUST be set and checked in the underlying + * transport. + * + * @todo - decode the input control packet, instead of + * this temporary hack. + */ + if (data_len > 0) { + RPEDEBUG("Failed decoding packet"); + return -1; + } + + /* + * Set the rest of the fields. + */ + memcpy(&request->client, &client, sizeof(client)); /* const issues */ + + request->packet->if_index = address->if_index; + request->packet->src_ipaddr = address->src_ipaddr; + request->packet->src_port = address->src_port; + request->packet->dst_ipaddr = address->dst_ipaddr; + request->packet->dst_port = address->dst_port; + + request->reply->if_index = address->if_index; + request->reply->src_ipaddr = address->dst_ipaddr; + request->reply->src_port = address->dst_port; + request->reply->dst_ipaddr = address->src_ipaddr; + request->reply->dst_port = address->src_port; + + request->root = &main_config; + REQUEST_VERIFY(request); + + if (!inst->io.app_io->decode) return 0; + + /* + * Let the app_io do anything it needs to do. + */ + return inst->io.app_io->decode(inst->io.app_io_instance, request, data, data_len); +} + +static ssize_t mod_encode(void const *instance, REQUEST *request, uint8_t *buffer, size_t buffer_len) +{ + proto_control_t const *inst = talloc_get_type_abort_const(instance, proto_control_t); + fr_io_track_t const *track = talloc_get_type_abort_const(request->async->packet_ctx, fr_io_track_t); + fr_io_address_t *address = track->address; + ssize_t data_len; + RADCLIENT const *client; + + /* + * The packet timed out. Tell the network side that the packet is dead. + */ + if (buffer_len == 1) { + *buffer = true; + return 1; + } + + /* + * "Do not respond" + */ + if ((request->reply->code == FR_CODE_DO_NOT_RESPOND) || + (request->reply->code == 0) || (request->reply->code >= FR_MAX_PACKET_CODE)) { + *buffer = false; + return 1; + } + + client = address->radclient; + rad_assert(client); + + /* + * Dynamic client stuff + */ + if (client->dynamic && !client->active) { + RADCLIENT *new_client; + + rad_assert(buffer_len >= sizeof(client)); + + /* + * Allocate the client. If that fails, send back a NAK. + * + * @todo - deal with NUMA zones? Or just deal with this + * client being in different memory. + * + * Maybe we should create a CONF_SECTION from the client, + * and pass *that* back to mod_write(), which can then + * parse it to create the actual client.... + */ + new_client = client_afrom_request(NULL, request); + if (!new_client) { + PERROR("Failed creating new client"); + buffer[0] = true; + return 1; + } + + memcpy(buffer, &new_client, sizeof(new_client)); + return sizeof(new_client); + } + + /* + * If the app_io encodes the packet, then we don't need + * to do that. + */ + if (inst->io.app_io->encode) { + data_len = inst->io.app_io->encode(inst->io.app_io_instance, request, buffer, buffer_len); + if (data_len > 0) return data_len; + } + +#ifdef WITH_UDPFROMTO + /* + * Overwrite the src ip address on the outbound packet + * with the one specified by the client. This is useful + * to work around broken DSR implementations and other + * routing issues. + */ + if (client->src_ipaddr.af != AF_UNSPEC) { + request->reply->src_ipaddr = client->src_ipaddr; + } +#endif + + /* + * @todo - encode the reply. + * + * If the reply is too large, find a way to gradually + * write it to the network side? + */ +#if 0 + data_len = fr_control_encode(buffer, buffer_len, request->packet->data, + request->reply->code, request->reply->id, request->reply->vps); +#else + data_len = -1; +#endif + if (data_len < 0) { + RPEDEBUG("Failed encoding CONTROL reply"); + return -1; + } + + return data_len; +} + +static void mod_entry_point_set(void const *instance, REQUEST *request) +{ + proto_control_t const *inst = talloc_get_type_abort_const(instance, proto_control_t); + fr_io_track_t *track = request->async->packet_ctx; + + request->server_cs = inst->io.server_cs; + + /* + * 'track' can be NULL when there's no network listener. + */ + if (inst->io.app_io && (track->dynamic == request->async->recv_time)) { + fr_app_worker_t const *app_process; + + app_process = (fr_app_worker_t const *) inst->dynamic_submodule->module->common; + + request->async->process = app_process->entry_point; + track->dynamic = 0; + return; + } + + rad_assert(inst->process != NULL); + request->async->process = inst->process; +} + + +static int mod_priority_set(UNUSED void const *instance, UNUSED uint8_t const *buffer, UNUSED size_t buflen) +{ + return PRIORITY_NOW; +} + +/** Open listen sockets/connect to external event source + * + * @param[in] instance Ctx data for this application. + * @param[in] sc to add our file descriptor to. + * @param[in] conf Listen section parsed to give us isntance. + * @return + * - 0 on success. + * - -1 on failure. + */ +static int mod_open(void *instance, fr_schedule_t *sc, CONF_SECTION *conf) +{ + fr_listen_t *listen; + proto_control_t *inst = talloc_get_type_abort(instance, proto_control_t); + + /* + * Build the #fr_listen_t. This describes the complete + * path, data takes from the socket to the decoder and + * back again. + */ + listen = talloc_zero(inst, fr_listen_t); + + listen->app = &proto_control; + listen->app_instance = instance; + listen->server_cs = inst->io.server_cs; + + /* + * Set configurable parameters for message ring buffer. + */ + listen->default_message_size = inst->max_packet_size; + listen->num_messages = inst->num_messages; + + /* + * Open the socket, and add it to the scheduler. + */ + if (inst->io.app_io) { + /* + * Set the listener to call our master trampoline function. + */ + listen->app_io = &fr_master_app_io; + listen->app_io_instance = inst; + + /* + * Don't set the connection for the main socket. It's not connected. + */ + if (inst->io.app_io->open(inst->io.app_io_instance) < 0) { + cf_log_err(conf, "Failed opening %s interface", inst->io.app_io->name); + talloc_free(listen); + return -1; + } + + /* + * Add the socket to the scheduler, which might + * end up in a different thread. + */ + if (!fr_schedule_socket_add(sc, listen)) { + talloc_free(listen); + return -1; + } + } else { + rad_assert(!inst->io.dynamic_clients); + } + + inst->io.listen = listen; /* Probably won't need it, but doesn't hurt */ + inst->io.sc = sc; + + return 0; +} + +/** Instantiate the application + * + * Instantiate I/O and type submodules. + * + * @param[in] instance Ctx data for this application. + * @param[in] conf Listen section parsed to give us instance. + * @return + * - 0 on success. + * - -1 on failure. + */ +static int mod_instantiate(void *instance, CONF_SECTION *conf) +{ + proto_control_t *inst = talloc_get_type_abort(instance, proto_control_t); + size_t i; + + CONF_PAIR *cp = NULL; + CONF_ITEM *ci; + CONF_SECTION *server = cf_item_to_section(cf_parent(conf)); + + /* + * Compile each "send/recv + CONTROL packet type" section. + * This is so that the submodules don't need to do this. + */ + i = 0; + for (ci = cf_item_next(server, NULL); + ci != NULL; + ci = cf_item_next(server, ci)) { + char const *name, *packet_type; + CONF_SECTION *subcs; + rlm_components_t component = MOD_AUTHORIZE; + + if (!cf_item_is_section(ci)) continue; + + subcs = cf_item_to_section(ci); + name = cf_section_name1(subcs); + + /* + * We only process recv/send sections. + * proto_control_auth will handle the + * "authenticate" sections. + */ + if ((strcmp(name, "recv") != 0) && + (strcmp(name, "send") != 0)) { + continue; + } + + /* + * One more "recv" or "send" section has been + * found. + */ + i++; + + /* + * Skip a section if it was already compiled. + */ + if (cf_data_find(subcs, unlang_group_t, NULL) != NULL) continue; + + /* + * Check that the packet type is known. + */ + packet_type = cf_section_name2(subcs); + if (packet_type) { + cf_log_err(subcs, "Invalid control packet type in '%s %s {...}'", + name, packet_type); + return -1; + } + + /* + * Try to compile it, and fail if it doesn't work. + */ + cf_log_debug(subcs, "compiling - %s {...}", name); + + if (strcmp(name, "send") == 0) component = MOD_POST_AUTH; + + if (unlang_compile(subcs, component) < 0) { + cf_log_err(subcs, "Failed compiling '%s { ... }' section", name); + return -1; + } + } + + /* + * No 'recv' or 'send' sections. That's an error. + */ + if (!i) { + cf_log_err(server, "Virtual servers cannot be empty."); + return -1; + } + + /* + * Instantiate the process modules + */ + i = 0; + while ((cp = cf_pair_find_next(conf, cp, "type"))) { + fr_app_worker_t const *app_process; + fr_dict_enum_t const *enumv; + + app_process = (fr_app_worker_t const *)inst->type_submodule[i]->module->common; + if (app_process->instantiate && (app_process->instantiate(inst->type_submodule[i]->data, + inst->type_submodule[i]->conf) < 0)) { + cf_log_err(conf, "Instantiation failed for \"%s\"", app_process->name); + return -1; + } + + /* + * We've already done bounds checking in the type_parse function + */ + enumv = cf_data_value(cf_data_find(cp, fr_dict_enum_t, NULL)); + if (!fr_cond_assert(enumv)) return -1; + + inst->process = app_process->entry_point; /* Store the state function */ + i++; + } + + /* + * No IO module, it's an empty listener. + */ + if (!i || !inst->io.submodule) return 0; + + /* + * These configuration items are not printed by default, + * because normal people shouldn't be touching them. + */ + if (!inst->max_packet_size && inst->io.app_io) inst->max_packet_size = inst->io.app_io->default_message_size; + + if (!inst->num_messages) inst->num_messages = 256; + + FR_INTEGER_BOUND_CHECK("num_messages", inst->num_messages, >=, 32); + FR_INTEGER_BOUND_CHECK("num_messages", inst->num_messages, <=, 65535); + + FR_INTEGER_BOUND_CHECK("max_packet_size", inst->max_packet_size, >=, 1024); + FR_INTEGER_BOUND_CHECK("max_packet_size", inst->max_packet_size, <=, 65535); + + /* + * Set talloc ctx for master IO. + */ + inst->io.ctx = inst; + + /* + * Instantiate the master io submodule + */ + if (fr_master_app_io.instantiate(&inst->io, conf) < 0) { + return -1; + + } + + /* + * No dynamic clients, nothing more to do. + */ + if (!inst->io.dynamic_clients) return 0; + + /* + * Instantiate proto_control_dynamic_client + */ + { + fr_app_worker_t const *app_process; + + app_process = (fr_app_worker_t const *)inst->dynamic_submodule->module->common; + if (app_process->instantiate && (app_process->instantiate(inst->dynamic_submodule->data, conf) < 0)) { + cf_log_err(conf, "Instantiation failed for \"%s\"", app_process->name); + return -1; + } + } + + return 0; +} + + +/** Bootstrap the application + * + * Bootstrap I/O and type submodules. + * + * @param[in] instance Ctx data for this application. + * @param[in] conf Listen section parsed to give us instance. + * @return + * - 0 on success. + * - -1 on failure. + */ +static int mod_bootstrap(void *instance, CONF_SECTION *conf) +{ + proto_control_t *inst = talloc_get_type_abort(instance, proto_control_t); + size_t i = 0; + CONF_PAIR *cp = NULL; + + /* + * Ensure that the server CONF_SECTION is always set. + */ + inst->io.server_cs = cf_item_to_section(cf_parent(conf)); + + /* + * Bootstrap the process modules + */ + while ((cp = cf_pair_find_next(conf, cp, "type"))) { + char const *value; + dl_t const *module = talloc_get_type_abort_const(inst->type_submodule[i]->module, dl_t); + fr_app_worker_t const *app_process = (fr_app_worker_t const *)module->common; + + if (app_process->bootstrap && (app_process->bootstrap(inst->type_submodule[i]->data, + inst->type_submodule[i]->conf) < 0)) { + cf_log_err(conf, "Bootstrap failed for \"%s\"", app_process->name); + return -1; + } + + value = cf_pair_value(cp); + + /* + * Add handlers for the virtual server calls. + * This is so that when one virtual server wants + * to call another, it just looks up the data + * here by packet name, and doesn't need to troll + * through all of the listeners. + */ + if (!cf_data_find(inst->io.server_cs, fr_io_process_t, value)) { + fr_io_process_t *process_p; + + rad_assert(inst->io.server_cs); /* Ensure we don't leak memory */ + + process_p = talloc(inst->io.server_cs, fr_io_process_t); + *process_p = app_process->entry_point; + + (void) cf_data_add(inst->io.server_cs, process_p, value, NULL); + } + + i++; + } + + /* + * No IO module, it's an empty listener. + */ + if (!inst->io.submodule) return 0; + + /* + * These timers are usually protocol specific. + */ + FR_TIMEVAL_BOUND_CHECK("idle_timeout", &inst->io.idle_timeout, >=, 1, 0); + FR_TIMEVAL_BOUND_CHECK("idle_timeout", &inst->io.idle_timeout, <=, 600, 0); + + FR_TIMEVAL_BOUND_CHECK("nak_lifetime", &inst->io.nak_lifetime, >=, 1, 0); + FR_TIMEVAL_BOUND_CHECK("nak_lifetime", &inst->io.nak_lifetime, <=, 600, 0); + + /* + * Tell the master handler about the main protocol instance. + */ + inst->io.app = &proto_control; + inst->io.app_instance = inst; + + /* + * We will need this for dynamic clients and connected sockets. + */ + inst->io.dl_inst = dl_instance_find(inst); + rad_assert(inst != NULL); + + /* + * Bootstrap the master IO handler. + */ + if (fr_master_app_io.bootstrap(&inst->io, conf) < 0) { + return -1; + } + + /* + * proto_control_udp determines if we have dynamic clients + * or not. + */ + if (!inst->io.dynamic_clients) return 0; + + /* + * Load proto_control_dynamic_client + */ + if (dl_instance(inst, &inst->dynamic_submodule, + conf, inst->io.dl_inst, "dynamic_client", DL_TYPE_SUBMODULE) < 0) { + cf_log_err(conf, "Failed finding proto_control_dynamic_client"); + return -1; + } + + /* + * Don't bootstrap the dynamic submodule. We're + * not even sure what that means... + */ + + return 0; +} + +static int mod_load(void) +{ + // load stuff? + + return 0; +} + +static void mod_unload(void) +{ + // unload stuff? +} + +fr_app_t proto_control = { + .magic = RLM_MODULE_INIT, + .name = "control", + .config = proto_control_config, + .inst_size = sizeof(proto_control_t), + + .load = mod_load, + .unload = mod_unload, + .bootstrap = mod_bootstrap, + .instantiate = mod_instantiate, + .open = mod_open, + .decode = mod_decode, + .encode = mod_encode, + .entry_point_set = mod_entry_point_set, + .priority = mod_priority_set +}; diff --git a/src/modules/proto_control/proto_control.h b/src/modules/proto_control/proto_control.h new file mode 100644 index 00000000000..58bfc3e21b3 --- /dev/null +++ b/src/modules/proto_control/proto_control.h @@ -0,0 +1,41 @@ +#pragma once +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/* + * $Id$ + * + * @file proto_control.h + * @brief Structures for the CONTROL protocol + * + * @copyright 2018 Alan DeKok + */ +#include + +/** An instance of a proto_control listen section + * + */ +typedef struct { + fr_io_instance_t io; //!< wrapper for IO abstraction + + dl_instance_t **type_submodule; //!< Instance of the various types + dl_instance_t *dynamic_submodule; //!< proto_control_dynamic_client + //!< only one instance per type allowed. + fr_io_process_t process; //!< process function + + uint32_t max_packet_size; //!< for message ring buffer. + uint32_t num_messages; //!< for message ring buffer. +} proto_control_t; diff --git a/src/modules/proto_control/proto_control.mk b/src/modules/proto_control/proto_control.mk new file mode 100644 index 00000000000..cb4f3a0411c --- /dev/null +++ b/src/modules/proto_control/proto_control.mk @@ -0,0 +1,9 @@ +TARGETNAME := proto_control + +ifneq "$(TARGETNAME)" "" +TARGET := $(TARGETNAME).a +endif + +SOURCES := proto_control.c + +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-util.a libfreeradius-radius.a libfreeradius-io.a diff --git a/src/modules/proto_control/proto_control_tcp.c b/src/modules/proto_control/proto_control_tcp.c new file mode 100644 index 00000000000..30e7cff189f --- /dev/null +++ b/src/modules/proto_control/proto_control_tcp.c @@ -0,0 +1,620 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/** + * $Id$ + * @file proto_control_tcp.c + * @brief Control handler for TCP. + * + * @copyright 2016 The FreeRADIUS server project. + * @copyright 2016 Alan DeKok (aland@deployingradius.com) + */ +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include "proto_control.h" + +typedef struct { + char const *name; //!< socket name + CONF_SECTION *cs; //!< our configuration + + int sockfd; + + fr_event_list_t *el; //!< for cleanup timers on Access-Request + fr_network_t *nr; //!< for fr_network_listen_read(); + + fr_ipaddr_t ipaddr; //!< IP address to listen on. + + char const *interface; //!< Interface to bind to. + char const *port_name; //!< Name of the port for getservent(). + + uint32_t recv_buff; //!< How big the kernel's receive buffer should be. + + uint32_t max_packet_size; //!< for message ring buffer. + + fr_stats_t stats; //!< statistics for this socket + + uint16_t port; //!< Port to listen on. + + bool recv_buff_is_set; //!< Whether we were provided with a receive + //!< buffer value. + bool dynamic_clients; //!< whether we have dynamic clients + + fr_trie_t *trie; //!< for parsed networks + fr_ipaddr_t *allow; //!< allowed networks for dynamic clients + fr_ipaddr_t *deny; //!< denied networks for dynamic clients + + fr_io_address_t *connection; //!< for connected sockets. + +} proto_control_tcp_t; + + +static const CONF_PARSER networks_config[] = { + { FR_CONF_OFFSET("allow", FR_TYPE_COMBO_IP_PREFIX | FR_TYPE_MULTI, proto_control_tcp_t, allow) }, + { FR_CONF_OFFSET("deny", FR_TYPE_COMBO_IP_PREFIX | FR_TYPE_MULTI, proto_control_tcp_t, deny) }, + + CONF_PARSER_TERMINATOR +}; + + +static const CONF_PARSER tcp_listen_config[] = { + { FR_CONF_OFFSET("ipaddr", FR_TYPE_COMBO_IP_ADDR, proto_control_tcp_t, ipaddr) }, + { FR_CONF_OFFSET("ipv4addr", FR_TYPE_IPV4_ADDR, proto_control_tcp_t, ipaddr) }, + { FR_CONF_OFFSET("ipv6addr", FR_TYPE_IPV6_ADDR, proto_control_tcp_t, ipaddr) }, + + { FR_CONF_OFFSET("interface", FR_TYPE_STRING, proto_control_tcp_t, interface) }, + { FR_CONF_OFFSET("port_name", FR_TYPE_STRING, proto_control_tcp_t, port_name) }, + + { FR_CONF_OFFSET("port", FR_TYPE_UINT16, proto_control_tcp_t, port) }, + { FR_CONF_IS_SET_OFFSET("recv_buff", FR_TYPE_UINT32, proto_control_tcp_t, recv_buff) }, + + { FR_CONF_OFFSET("dynamic_clients", FR_TYPE_BOOL, proto_control_tcp_t, dynamic_clients) } , + { FR_CONF_POINTER("networks", FR_TYPE_SUBSECTION, NULL), .subcs = (void const *) networks_config }, + + { FR_CONF_OFFSET("max_packet_size", FR_TYPE_UINT32, proto_control_tcp_t, max_packet_size), .dflt = "4096" } , + + CONF_PARSER_TERMINATOR +}; + + +static ssize_t mod_read(void *instance, UNUSED void **packet_ctx, fr_time_t **recv_time, uint8_t *buffer, size_t buffer_len, size_t *leftover, UNUSED uint32_t *priority, UNUSED bool *is_dup) +{ + proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t); + ssize_t data_size; + size_t packet_len = -1; + + fr_time_t *recv_time_p; + + recv_time_p = *recv_time; + + /* + * Read data into the buffer. + */ + data_size = read(inst->sockfd, buffer + *leftover, buffer_len - *leftover); + if (data_size < 0) { + DEBUG2("proto_control_tcp got read error %zd: %s", data_size, fr_strerror()); + return data_size; + } + + /* + * Note that we return ERROR for all bad packets, as + * there's no point in reading packets from a TCP + * connection which isn't sending us properly formatted + * packets. + */ + + /* + * TCP read of zero means the socket is dead. + */ + if (!data_size) { + DEBUG2("proto_control_tcp - other side closed the socket."); + return -1; + } + + // @todo - check authentication, etc. on the socket. + // we will need a state machine for this.. + + /* + * Not enough for one packet. Tell the caller that we need to read more. + */ + if (data_size < 20) { + *leftover = data_size; + return 0; + } + +#if 0 + /* + * If it's not a RADIUS packet, ignore it. + */ + if (!fr_radius_ok(buffer, &packet_len, inst->max_attributes, false, &reason)) { + /* + * @todo - check for F5 load balancer packets. + */ + DEBUG2("proto_control_tcp got a packet which isn't RADIUS"); + inst->stats.total_malformed_requests++; + return -1; + } +#endif + + // @todo - maybe convert timestamp? + *recv_time_p = fr_time(); + + /* + * proto_control sets the priority + */ + + /* + * Print out what we received. + */ + DEBUG2("proto_control_tcp - Received %s ID %d length %d %s", + fr_packet_codes[buffer[0]], buffer[1], + (int) packet_len, inst->name); + + return packet_len; +} + + +static ssize_t mod_write(void *instance, void *packet_ctx, + UNUSED fr_time_t request_time, uint8_t *buffer, size_t buffer_len) +{ + proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t); + fr_io_track_t *track = talloc_get_type_abort(packet_ctx, fr_io_track_t); + ssize_t data_size; + + /* + * @todo - share a stats interface with the parent? or + * put the stats in the listener, so that proto_control + * can update them, too.. + */ + inst->stats.total_responses++; + + /* + * This handles the race condition where we get a DUP, + * but the original packet replies before we're run. + * i.e. this packet isn't marked DUP, so we have to + * discover it's a dup later... + * + * As such, if there's already a reply, then we ignore + * the encoded reply (which is probably going to be a + * NAK), and instead just ignore the DUP and don't reply. + */ + if (track->reply_len) { + return buffer_len; + } + + /* + * We only write RADIUS packets. + */ + rad_assert(buffer_len >= 20); + + /* + * Only write replies if they're RADIUS packets. + * sometimes we want to NOT send a reply... + */ + data_size = write(inst->sockfd, buffer, buffer_len); + + // @todo - catch EWOULDBLOCK + // @todo - catch partial writes + + /* + * This socket is dead. That's an error... + */ + if (data_size <= 0) return data_size; + + /* + * Root through the reply to determine any + * connection-level negotiation data. + */ + if (track->packet[0] == FR_CODE_STATUS_SERVER) { +// status_check_reply(inst, buffer, buffer_len); + } + + return data_size; +} + + +/** Close a TCP listener for RADIUS + * + * @param[in] instance of the RADIUS TCP I/O path. + * @return + * - <0 on error + * - 0 on success + */ +static int mod_close(void *instance) +{ + proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t); + + close(inst->sockfd); + inst->sockfd = -1; + + return 0; +} + +static int mod_connection_set(void *instance, fr_io_address_t *connection) +{ + proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t); + + inst->connection = connection; + return 0; +} + + +static void mod_network_get(void *instance, int *ipproto, bool *dynamic_clients, fr_trie_t const **trie) +{ + proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t); + + *ipproto = IPPROTO_TCP; + *dynamic_clients = inst->dynamic_clients; + *trie = inst->trie; +} + + +/** Open a TCP listener for RADIUS + * + * @param[in] instance of the RADIUS TCP I/O path. + * @return + * - <0 on error + * - 0 on success + */ +static int mod_open(void *instance) +{ + proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t); + + int sockfd = 0; + uint16_t port = inst->port; + CONF_SECTION *server_cs; + CONF_ITEM *ci; + + rad_assert(!inst->connection); + + sockfd = fr_socket_server_tcp(&inst->ipaddr, &port, inst->port_name, true); + if (sockfd < 0) { + PERROR("Failed opening TCP socket"); + error: + return -1; + } + + if (fr_socket_bind(sockfd, &inst->ipaddr, &port, inst->interface) < 0) { + close(sockfd); + PERROR("Failed binding socket"); + goto error; + } + + if (listen(sockfd, 8) < 0) { + close(sockfd); + PERROR("Failed listening on socket"); + goto error; + } + + inst->sockfd = sockfd; + + ci = cf_parent(inst->cs); /* listen { ... } */ + rad_assert(ci != NULL); + ci = cf_parent(ci); + rad_assert(ci != NULL); + + server_cs = cf_item_to_section(ci); + + // @todo - also print out auth / acct / coa, etc. + DEBUG("Listening on control address %s bound to virtual server %s", + inst->name, cf_section_name2(server_cs)); + + return 0; +} + +/** Get the file descriptor for this socket. + * + * @param[in] instance of the RADIUS TCP I/O path. + * @return the file descriptor + */ +static int mod_fd(void const *instance) +{ + proto_control_tcp_t const *inst = talloc_get_type_abort_const(instance, proto_control_tcp_t); + + return inst->sockfd; +} + +/** Set the file descriptor for this socket. + * + * @param[in] instance of the RADIUS TCP I/O path. + * @param[in] fd the FD to set + */ +static void mod_fd_set(void *instance, int fd) +{ + proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t); + + inst->sockfd = fd; +} + +static int mod_instantiate(void *instance, UNUSED CONF_SECTION *cs) +{ + proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t); + char dst_buf[128]; + + /* + * Get our name. + */ + if (fr_ipaddr_is_inaddr_any(&inst->ipaddr)) { + if (inst->ipaddr.af == AF_INET) { + strlcpy(dst_buf, "*", sizeof(dst_buf)); + } else { + rad_assert(inst->ipaddr.af == AF_INET6); + strlcpy(dst_buf, "::", sizeof(dst_buf)); + } + } else { + fr_value_box_snprint(dst_buf, sizeof(dst_buf), fr_box_ipaddr(inst->ipaddr), 0); + } + + if (!inst->connection) { + inst->name = talloc_typed_asprintf(inst, "proto tcp server %s port %u", + dst_buf, inst->port); + + } else { + char src_buf[128]; + + fr_value_box_snprint(src_buf, sizeof(src_buf), fr_box_ipaddr(inst->connection->src_ipaddr), 0); + + inst->name = talloc_typed_asprintf(inst, "proto tcp from client %s port %u to server %s port %u", + src_buf, inst->connection->src_port, dst_buf, inst->port); + } + + return 0; +} + + +static int mod_bootstrap(void *instance, CONF_SECTION *cs) +{ + proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t); + size_t i, num; + + inst->cs = cs; + + /* + * Complain if no "ipaddr" is set. + */ + if (inst->ipaddr.af == AF_UNSPEC) { + cf_log_err(cs, "No 'ipaddr' was specified in the 'tcp' section"); + return -1; + } + + if (inst->recv_buff_is_set) { + FR_INTEGER_BOUND_CHECK("recv_buff", inst->recv_buff, >=, 32); + FR_INTEGER_BOUND_CHECK("recv_buff", inst->recv_buff, <=, INT_MAX); + } + + FR_INTEGER_BOUND_CHECK("max_packet_size", inst->max_packet_size, >=, 20); + FR_INTEGER_BOUND_CHECK("max_packet_size", inst->max_packet_size, <=, 65536); + + if (!inst->port) { + struct servent *s; + + if (!inst->port_name) { + cf_log_err(cs, "No 'port' was specified in the 'tcp' section"); + return -1; + } + + s = getservbyname(inst->port_name, "tcp"); + if (!s) { + cf_log_err(cs, "Unknown value for 'port_name = %s", inst->port_name); + return -1; + } + + inst->port = ntohl(s->s_port); + } + + /* + * Parse and create the trie for dynamic clients, even if + * there's no dynamic clients. + * + * @todo - we could use this for source IP filtering? + * e.g. allow clients from a /16, but not from a /24 + * within that /16. + */ + num = talloc_array_length(inst->allow); + if (!num) { + if (inst->dynamic_clients) { + cf_log_err(cs, "The 'allow' subsection MUST contain at least one 'network' entry when 'dynamic_clients = true'."); + return -1; + } + } else { + MEM(inst->trie = fr_trie_alloc(inst)); + + for (i = 0; i < num; i++) { + fr_ipaddr_t *network; + char buffer[256]; + + /* + * Can't add v4 networks to a v6 socket, or vice versa. + */ + if (inst->allow[i].af != inst->ipaddr.af) { + fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->allow[i]), 0); + cf_log_err(cs, "Address family in entry %zd - 'allow = %s' does not match 'ipaddr'", i + 1, buffer); + return -1; + } + + /* + * Duplicates are bad. + */ + network = fr_trie_match(inst->trie, + &inst->allow[i].addr, inst->allow[i].prefix); + if (network) { + fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->allow[i]), 0); + cf_log_err(cs, "Cannot add duplicate entry 'allow = %s'", buffer); + return -1; + } + + /* + * Look for overlapping entries. + * i.e. the networks MUST be disjoint. + * + * Note that this catches 192.168.1/24 + * followed by 192.168/16, but NOT the + * other way around. The best fix is + * likely to add a flag to + * fr_trie_alloc() saying "we can only + * have terminal fr_trie_user_t nodes" + */ + network = fr_trie_lookup(inst->trie, + &inst->allow[i].addr, inst->allow[i].prefix); + if (network && (network->prefix <= inst->allow[i].prefix)) { + fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->allow[i]), 0); + cf_log_err(cs, "Cannot add overlapping entry 'allow = %s'", buffer); + cf_log_err(cs, "Entry is completely enclosed inside of a previously defined network."); + return -1; + } + + /* + * Insert the network into the trie. + * Lookups will return the fr_ipaddr_t of + * the network. + */ + if (fr_trie_insert(inst->trie, + &inst->allow[i].addr, inst->allow[i].prefix, + &inst->allow[i]) < 0) { + fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->allow[i]), 0); + cf_log_err(cs, "Failed adding 'allow = %s' to tracking table.", buffer); + return -1; + } + } + + /* + * And now check denied networks. + */ + num = talloc_array_length(inst->deny); + if (!num) return 0; + + /* + * Since the default is to deny, you can only add + * a "deny" inside of a previous "allow". + */ + for (i = 0; i < num; i++) { + fr_ipaddr_t *network; + char buffer[256]; + + /* + * Can't add v4 networks to a v6 socket, or vice versa. + */ + if (inst->deny[i].af != inst->ipaddr.af) { + fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->deny[i]), 0); + cf_log_err(cs, "Address family in entry %zd - 'deny = %s' does not match 'ipaddr'", i + 1, buffer); + return -1; + } + + /* + * Duplicates are bad. + */ + network = fr_trie_match(inst->trie, + &inst->deny[i].addr, inst->deny[i].prefix); + if (network) { + fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->deny[i]), 0); + cf_log_err(cs, "Cannot add duplicate entry 'deny = %s'", buffer); + return -1; + } + + /* + * A "deny" can only be within a previous "allow". + */ + network = fr_trie_lookup(inst->trie, + &inst->deny[i].addr, inst->deny[i].prefix); + if (!network) { + fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->deny[i]), 0); + cf_log_err(cs, "The network in entry %zd - 'deny = %s' is not contained within a previous 'allow'", + i + 1, buffer); + return -1; + } + + /* + * We hack the AF in "deny" rules. If + * the lookup gets AF_UNSPEC, then we're + * adding a "deny" inside of a "deny". + */ + if (network->af != inst->ipaddr.af) { + fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->deny[i]), 0); + cf_log_err(cs, "The network in entry %zd - 'deny = %s' is overlaps with another 'deny' rule", + i + 1, buffer); + return -1; + } + + /* + * Insert the network into the trie. + * Lookups will return the fr_ipaddr_t of + * the network. + */ + if (fr_trie_insert(inst->trie, + &inst->deny[i].addr, inst->deny[i].prefix, + &inst->deny[i]) < 0) { + fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->deny[i]), 0); + cf_log_err(cs, "Failed adding 'deny = %s' to tracking table.", buffer); + return -1; + } + + /* + * Hack it to make it a deny rule. + */ + inst->deny[i].af = AF_UNSPEC; + } + } + + return 0; +} + +static RADCLIENT *mod_client_find(UNUSED void *instance, fr_ipaddr_t const *ipaddr, int ipproto) +{ + return client_find(NULL, ipaddr, ipproto); +} + +#if 0 +static int mod_detach(void *instance) +{ + proto_control_tcp_t *inst = talloc_get_type_abort(instance, proto_control_tcp_t); + + if (inst->sockfd >= 0) close(inst->sockfd); + inst->sockfd = -1; + + return 0; +} +#endif + +extern fr_app_io_t proto_control_tcp; +fr_app_io_t proto_control_tcp = { + .magic = RLM_MODULE_INIT, + .name = "control_tcp", + .config = tcp_listen_config, + .inst_size = sizeof(proto_control_tcp_t), +// .detach = mod_detach, + .bootstrap = mod_bootstrap, + .instantiate = mod_instantiate, + + .default_message_size = 4096, + + .open = mod_open, + .read = mod_read, + .write = mod_write, + .close = mod_close, + .fd = mod_fd, + .fd_set = mod_fd_set, + .connection_set = mod_connection_set, + .network_get = mod_network_get, + .client_find = mod_client_find, +}; diff --git a/src/modules/proto_control/proto_control_tcp.mk b/src/modules/proto_control/proto_control_tcp.mk new file mode 100644 index 00000000000..78fab9a497a --- /dev/null +++ b/src/modules/proto_control/proto_control_tcp.mk @@ -0,0 +1,9 @@ +TARGETNAME := proto_control_tcp + +ifneq "$(TARGETNAME)" "" +TARGET := $(TARGETNAME).a +endif + +SOURCES := proto_control_tcp.c + +TGT_PREREQS := libfreeradius-util.a diff --git a/src/modules/proto_control/proto_control_unix.c b/src/modules/proto_control/proto_control_unix.c new file mode 100644 index 00000000000..0754e64c09d --- /dev/null +++ b/src/modules/proto_control/proto_control_unix.c @@ -0,0 +1,383 @@ +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/** + * $Id$ + * @file proto_control_unix.c + * @brief Control handler for Unix sockets. + * + * @copyright 2016 The FreeRADIUS server project. + * @copyright 2016 Alan DeKok (aland@deployingradius.com) + */ +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include "proto_control.h" + +typedef struct { + char const *name; //!< socket name + CONF_SECTION *cs; //!< our configuration + + int sockfd; + + fr_event_list_t *el; //!< for cleanup timers on Access-Request + fr_network_t *nr; //!< for fr_network_listen_read(); + + char const *path; //!< path to socket name + + uint32_t recv_buff; //!< How big the kernel's receive buffer should be. + + uint32_t max_packet_size; //!< for message ring buffer. + + fr_stats_t stats; //!< statistics for this socket + + bool recv_buff_is_set; //!< Whether we were provided with a receive + //!< buffer value. + + fr_io_address_t *connection; //!< for connected sockets. + +} proto_control_unix_t; + +static const CONF_PARSER unix_listen_config[] = { + { FR_CONF_OFFSET("path", FR_TYPE_STRING, proto_control_unix_t, path) }, + { FR_CONF_IS_SET_OFFSET("recv_buff", FR_TYPE_UINT32, proto_control_unix_t, recv_buff) }, + + { FR_CONF_OFFSET("max_packet_size", FR_TYPE_UINT32, proto_control_unix_t, max_packet_size), .dflt = "4096" } , + + CONF_PARSER_TERMINATOR +}; + + +static ssize_t mod_read(void *instance, UNUSED void **packet_ctx, fr_time_t **recv_time, uint8_t *buffer, size_t buffer_len, size_t *leftover, UNUSED uint32_t *priority, UNUSED bool *is_dup) +{ + proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t); + ssize_t data_size; + size_t packet_len = -1; + + fr_time_t *recv_time_p; + + recv_time_p = *recv_time; + + /* + * Read data into the buffer. + */ + data_size = read(inst->sockfd, buffer + *leftover, buffer_len - *leftover); + if (data_size < 0) { + DEBUG2("proto_control_unix got read error %zd: %s", data_size, fr_strerror()); + return data_size; + } + + /* + * Note that we return ERROR for all bad packets, as + * there's no point in reading packets from a UNIX + * connection which isn't sending us properly formatted + * packets. + */ + + /* + * UNIX read of zero means the socket is dead. + */ + if (!data_size) { + DEBUG2("proto_control_unix - other side closed the socket."); + return -1; + } + + // @todo - check authentication, etc. on the socket. + // we will need a state machine for this.. + + /* + * Not enough for one packet. Tell the caller that we need to read more. + */ + if (data_size < 20) { + *leftover = data_size; + return 0; + } + +#if 0 + /* + * If it's not a RADIUS packet, ignore it. + */ + if (!fr_radius_ok(buffer, &packet_len, inst->max_attributes, false, &reason)) { + /* + * @todo - check for F5 load balancer packets. + */ + DEBUG2("proto_control_unix got a packet which isn't RADIUS"); + inst->stats.total_malformed_requests++; + return -1; + } +#endif + + // @todo - maybe convert timestamp? + *recv_time_p = fr_time(); + + /* + * proto_control sets the priority + */ + + /* + * Print out what we received. + */ + DEBUG2("proto_control_unix - Received %s ID %d length %d %s", + fr_packet_codes[buffer[0]], buffer[1], + (int) packet_len, inst->name); + + return packet_len; +} + + +static ssize_t mod_write(void *instance, void *packet_ctx, + UNUSED fr_time_t request_time, uint8_t *buffer, size_t buffer_len) +{ + proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t); + fr_io_track_t *track = talloc_get_type_abort(packet_ctx, fr_io_track_t); + ssize_t data_size; + + /* + * @todo - share a stats interface with the parent? or + * put the stats in the listener, so that proto_control + * can update them, too.. + */ + inst->stats.total_responses++; + + /* + * This handles the race condition where we get a DUP, + * but the original packet replies before we're run. + * i.e. this packet isn't marked DUP, so we have to + * discover it's a dup later... + * + * As such, if there's already a reply, then we ignore + * the encoded reply (which is probably going to be a + * NAK), and instead just ignore the DUP and don't reply. + */ + if (track->reply_len) { + return buffer_len; + } + + /* + * We only write RADIUS packets. + */ + rad_assert(buffer_len >= 20); + + /* + * Only write replies if they're RADIUS packets. + * sometimes we want to NOT send a reply... + */ + data_size = write(inst->sockfd, buffer, buffer_len); + + // @todo - catch EWOULDBLOCK + // @todo - catch partial writes + + /* + * This socket is dead. That's an error... + */ + if (data_size <= 0) return data_size; + + /* + * Root through the reply to determine any + * connection-level negotiation data. + */ + if (track->packet[0] == FR_CODE_STATUS_SERVER) { +// status_check_reply(inst, buffer, buffer_len); + } + + return data_size; +} + + +/** Close a UNIX listener for RADIUS + * + * @param[in] instance of the RADIUS UNIX I/O path. + * @return + * - <0 on error + * - 0 on success + */ +static int mod_close(void *instance) +{ + proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t); + + close(inst->sockfd); + inst->sockfd = -1; + + return 0; +} + +static int mod_connection_set(void *instance, fr_io_address_t *connection) +{ + proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t); + + inst->connection = connection; + return 0; +} + + +/** Open a UNIX listener for RADIUS + * + * @param[in] instance of the RADIUS UNIX I/O path. + * @return + * - <0 on error + * - 0 on success + */ +static int mod_open(void *instance) +{ + proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t); + + int sockfd = 0; + CONF_SECTION *server_cs; + CONF_ITEM *ci; + + rad_assert(!inst->connection); + +#if 0 + // @todo - open / create the Unix socket + sockfd = fr_socket_server_unix(&inst->ipaddr, &port, inst->port_name, true); +#else + sockfd = -1; +#endif + if (sockfd < 0) { + PERROR("Failed opening UNIX socket"); + error: + return -1; + } + + if (listen(sockfd, 8) < 0) { + close(sockfd); + PERROR("Failed listening on socket"); + goto error; + } + + inst->sockfd = sockfd; + + ci = cf_parent(inst->cs); /* listen { ... } */ + rad_assert(ci != NULL); + ci = cf_parent(ci); + rad_assert(ci != NULL); + + server_cs = cf_item_to_section(ci); + + // @todo - also print out auth / acct / coa, etc. + DEBUG("Listening on control address %s bound to virtual server %s", + inst->name, cf_section_name2(server_cs)); + + return 0; +} + +/** Get the file descriptor for this socket. + * + * @param[in] instance of the RADIUS UNIX I/O path. + * @return the file descriptor + */ +static int mod_fd(void const *instance) +{ + proto_control_unix_t const *inst = talloc_get_type_abort_const(instance, proto_control_unix_t); + + return inst->sockfd; +} + +/** Set the file descriptor for this socket. + * + * @param[in] instance of the RADIUS UNIX I/O path. + * @param[in] fd the FD to set + */ +static void mod_fd_set(void *instance, int fd) +{ + proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t); + + inst->sockfd = fd; +} + + +static int mod_instantiate(void *instance, UNUSED CONF_SECTION *cs) +{ + proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t); + char dst_buf[128]; + + if (!inst->connection) { + inst->name = talloc_typed_asprintf(inst, "proto unix server %s path %s", + dst_buf, inst->path); + + } else { + inst->name = talloc_typed_asprintf(inst, "proto unix from client ??? to server path %s", + inst->path); + } + + return 0; +} + + +static int mod_bootstrap(void *instance, CONF_SECTION *cs) +{ + proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t); + + inst->cs = cs; + + if (inst->recv_buff_is_set) { + FR_INTEGER_BOUND_CHECK("recv_buff", inst->recv_buff, >=, 32); + FR_INTEGER_BOUND_CHECK("recv_buff", inst->recv_buff, <=, INT_MAX); + } + + FR_INTEGER_BOUND_CHECK("max_packet_size", inst->max_packet_size, >=, 20); + FR_INTEGER_BOUND_CHECK("max_packet_size", inst->max_packet_size, <=, 65536); + + return 0; +} + +static RADCLIENT *mod_client_find(UNUSED void *instance, fr_ipaddr_t const *ipaddr, int ipproto) +{ + // @todo - stream sockets? + return client_find(NULL, ipaddr, ipproto); +} + +#if 0 +static int mod_detach(void *instance) +{ + proto_control_unix_t *inst = talloc_get_type_abort(instance, proto_control_unix_t); + + if (inst->sockfd >= 0) close(inst->sockfd); + inst->sockfd = -1; + + return 0; +} +#endif + +extern fr_app_io_t proto_control_unix; +fr_app_io_t proto_control_unix = { + .magic = RLM_MODULE_INIT, + .name = "control_unix", + .config = unix_listen_config, + .inst_size = sizeof(proto_control_unix_t), +// .detach = mod_detach, + .bootstrap = mod_bootstrap, + .instantiate = mod_instantiate, + + .default_message_size = 4096, + .track_duplicates = true, + + .open = mod_open, + .read = mod_read, + .write = mod_write, + .close = mod_close, + .fd = mod_fd, + .fd_set = mod_fd_set, + .connection_set = mod_connection_set, + .client_find = mod_client_find, +}; diff --git a/src/modules/proto_control/proto_control_unix.mk b/src/modules/proto_control/proto_control_unix.mk new file mode 100644 index 00000000000..d7285816ade --- /dev/null +++ b/src/modules/proto_control/proto_control_unix.mk @@ -0,0 +1,9 @@ +TARGETNAME := proto_control_unix + +ifneq "$(TARGETNAME)" "" +TARGET := $(TARGETNAME).a +endif + +SOURCES := proto_control_unix.c + +TGT_PREREQS := libfreeradius-util.a diff --git a/src/main/radmin.c b/src/modules/proto_control/radmin.c similarity index 99% rename from src/main/radmin.c rename to src/modules/proto_control/radmin.c index a0eb10144c3..02d0a88d8dc 100644 --- a/src/main/radmin.c +++ b/src/modules/proto_control/radmin.c @@ -66,8 +66,8 @@ RCSID("$Id$") #include #include -#include #include +#include "conduit.h" /* * For configuration file stuff. diff --git a/src/main/radmin.mk b/src/modules/proto_control/radmin.mk similarity index 58% rename from src/main/radmin.mk rename to src/modules/proto_control/radmin.mk index bbc00bbde30..2258035df49 100644 --- a/src/main/radmin.mk +++ b/src/modules/proto_control/radmin.mk @@ -4,8 +4,8 @@ ifneq "$(LIBREADLINE)" "" TARGET := $(TARGETNAME) endif -SOURCES := radmin.c conduit.c +SOURCES := radmin.c TGT_INSTALLDIR := ${sbindir} -TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-util.a +TGT_PREREQS := $(LIBFREERADIUS_SERVER) libfreeradius-util.a libfreeradius-control.a TGT_LDLIBS := $(LIBS) $(LIBREADLINE)