/src/freeradius-server/src/lib/server/virtual_servers.c

Source
/*
 *   This program is free software; you can redistribute it and/or modify
 *   it under the terms of the GNU General Public License as published by
 *   the Free Software Foundation; either version 2 of the License, or
 *   (at your option) any later version.
 *
 *   This program is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *   GNU General Public License for more details.
 *
 *   You should have received a copy of the GNU General Public License
 *   along with this program; if not, write to the Free Software
 *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
 */

/**
 * $Id: d3fed13facfdd0b1a3de45cafe9c88488a83a550 $
 *
 * @file virtual_servers.c
 * @brief Defines functions for virtual_server initialisation.
 *
 * @copyright 2003,2006 The FreeRADIUS server project
 * @copyright 2000 Alan DeKok (aland@freeradius.org)
 * @copyright 2000 Alan Curry (pacman@world.std.com)
 */
RCSID("$Id: d3fed13facfdd0b1a3de45cafe9c88488a83a550 $")

#include <freeradius-devel/protocol/freeradius/freeradius.internal.h>
#include <freeradius-devel/server/base.h>
#include <freeradius-devel/server/process_types.h>

#include <freeradius-devel/unlang/compile.h>
#include <freeradius-devel/unlang/function.h>
#include <freeradius-devel/unlang/finally.h>

#include <freeradius-devel/io/application.h>
#include <freeradius-devel/io/master.h>
#include <freeradius-devel/io/listen.h>

#include <freeradius-devel/util/debug.h>

typedef struct {
  module_instance_t   *proto_mi;      //!< The proto_* module for a listen section.
  fr_app_t const      *proto_module;      //!< Public interface to the proto_mi.
                  ///< cached for convenience.
} virtual_server_listen_t;

struct virtual_server_s {
  CONF_SECTION      *server_cs;     //!< The server section.
  virtual_server_listen_t   **listeners;      //!< Listeners in this virtual server.

  module_instance_t   *process_mi;      //!< The process_* module for a virtual server.
                  ///< Contains the dictionary used by the virtual
                  ///< server and the entry point for the state machine.
  fr_process_module_t const *process_module;    //!< Public interface to the process_mi.
                  ///< cached for convenience.

  fr_rb_tree_t      *sections;      //!< List of sections that need to be compiled.

  fr_log_t      *log;       //!< log destination
  char const      *log_name;      //!< name of log destination

  void        **finally_by_packet_type; //!< Finalise instruction by packet type.
  void        *finally_default;   //!< Default finally instruction.
};

static fr_dict_t const *dict_freeradius;

static fr_dict_attr_t const *attr_auth_type;

extern fr_dict_autoload_t virtual_server_dict_autoload[];
fr_dict_autoload_t virtual_server_dict_autoload[] = {
  { .out = &dict_freeradius, .proto = "freeradius" },
  DICT_AUTOLOAD_TERMINATOR
};

extern fr_dict_attr_autoload_t virtual_server_dict_attr_autoload[];
fr_dict_attr_autoload_t virtual_server_dict_attr_autoload[] = {
  { .out = &attr_auth_type, .name = "Auth-Type", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },

  DICT_AUTOLOAD_TERMINATOR
};

/** List of process modules we've loaded
 *
 * This is global for all virtual servers.  Must be initialised
 * _before_ the configuration is loaded.
 */
static module_list_t  *process_modules;

/** List of proto modules we've loaded
 *
 * This is global for all virtual servers.  Must be initialised
 * _before_ the configuration is loaded.
 */
static module_list_t  *proto_modules;

/** Top level structure holding all virtual servers
 *
 */
static virtual_server_t **virtual_servers;

/** CONF_SECTION holding all the virtual servers
 *
 * Set during the call to virtual_server_bootstrap and used by
 * other virtual server functions.
 */
static CONF_SECTION *virtual_server_root;

static fr_rb_tree_t *listen_addr_root = NULL;

static int namespace_on_read(TALLOC_CTX *ctx, void *out, UNUSED void *parent, CONF_ITEM *ci, conf_parser_t const *rule);

static int namespace_parse(TALLOC_CTX *ctx, void *out, UNUSED void *parent, CONF_ITEM *ci, conf_parser_t const *rule);
static int listen_parse(TALLOC_CTX *ctx, void *out, UNUSED void *parent, CONF_ITEM *ci, conf_parser_t const *rule);
static int server_parse(TALLOC_CTX *ctx, void *out, UNUSED void *parent, CONF_ITEM *ci, UNUSED conf_parser_t const *rule);

static const conf_parser_t server_on_read_config[] = {
  { FR_CONF_OFFSET_TYPE_FLAGS("namespace", FR_TYPE_VOID, CONF_FLAG_REQUIRED, virtual_server_t, process_mi),
      .on_read = namespace_on_read },

  CONF_PARSER_TERMINATOR
};

const conf_parser_t virtual_servers_on_read_config[] = {
  /*
   *  Not really ok if it's missing but we want to
   *  let logic elsewhere handle the issue.
   */
  { FR_CONF_POINTER("server", 0, CONF_FLAG_SUBSECTION | CONF_FLAG_OK_MISSING | CONF_FLAG_MULTI, &virtual_servers),
        .subcs_size = sizeof(virtual_server_t), .subcs_type = "virtual_server_t",
        .subcs = (void const *) server_on_read_config, .name2 = CF_IDENT_ANY,
        .on_read = cf_null_on_read },

  CONF_PARSER_TERMINATOR
};

static const conf_parser_t server_config[] = {
  { FR_CONF_OFFSET_TYPE_FLAGS("namespace", FR_TYPE_VOID, CONF_FLAG_REQUIRED, virtual_server_t, process_mi),
       .func = namespace_parse },

  { FR_CONF_OFFSET_TYPE_FLAGS("listen", FR_TYPE_VOID, CONF_FLAG_SUBSECTION | CONF_FLAG_OK_MISSING | CONF_FLAG_MULTI,
       virtual_server_t, listeners),
       .name2 = CF_IDENT_ANY,
       .subcs_size = sizeof(virtual_server_listen_t), .subcs_type = "virtual_server_listen_t",
       .func = listen_parse },

  { FR_CONF_OFFSET("log", virtual_server_t, log_name), },

  CONF_PARSER_TERMINATOR
};

const conf_parser_t virtual_servers_config[] = {
  /*
   *  Not really ok if it's missing but we want to
   *  let logic elsewhere handle the issue.
   */
  { FR_CONF_POINTER("server", 0, CONF_FLAG_SUBSECTION | CONF_FLAG_OK_MISSING | CONF_FLAG_MULTI, &virtual_servers),
        .subcs_size = sizeof(virtual_server_t), .subcs_type = "virtual_server_t",
        .subcs = (void const *) server_config, .name2 = CF_IDENT_ANY,
        .func = server_parse },

  CONF_PARSER_TERMINATOR
};

/** Print all the loaded listener instances
 *
 */
void virtual_server_listen_debug(void)
{
  module_list_debug(proto_modules);
}

/** Print all the loaded process module instances
 *
 */
void virtual_server_process_debug(void)
{
  module_list_debug(process_modules);
}

/** Resolve proto data to a module instance
 *
 * @param[in] data  Pointer to the proto data.
 * @return
 *  - The module instance for the proto data.
 *  - NULL if no data matches.
 */
module_instance_t *virtual_server_listener_by_data(void const *data)
{
  return module_instance_by_data(proto_modules, data);
}

/** Generic conf_parser_t func for loading drivers
 *
 */
int virtual_server_listen_transport_parse(TALLOC_CTX *ctx, void *out, void *parent,
           CONF_ITEM *ci, conf_parser_t const *rule)
{
  conf_parser_t our_rule = *rule;

  our_rule.uctx = &proto_modules;

  return module_submodule_parse(ctx, out, parent, ci, &our_rule);
}

/** Parse a "namespace" parameter
 *
 * We need to load the process module before continuing to parse the virtual server contents
 * as we need to know the namespace so that we can resolve attribute names.
 *
 * We also need the compilation list from the proto module to figure out which sections we
 * need to compile.
 *
 * @param[in] ctx to allocate data in.
 * @param[out] out  always NULL
 * @param[in] parent  Base structure address.
 * @param[in] ci  #CONF_SECTION containing the listen section.
 * @param[in] rule  unused.
 * @return
 *  - 0 on success.
 *  - -1 on failure.
 */
static int namespace_on_read(TALLOC_CTX *ctx, UNUSED void *out, UNUSED void *parent,
           CONF_ITEM *ci, UNUSED conf_parser_t const *rule)
{
  CONF_PAIR     *cp = cf_item_to_pair(ci);
  CONF_SECTION      *server_cs = cf_item_to_section(cf_parent(ci));
  module_instance_t   *mi;
  char const      *namespace;
  char        *module_name, *p, *end;
  char const      *inst_name;
  fr_process_module_t const *process;

  fr_cond_assert_msg(process_modules,
         "virtual_servers_init MUST be called before reading virtual server config");

  namespace = cf_pair_value(cp);
  module_name = talloc_strdup(ctx, namespace);

  /*
   *  Smush all hyphens to underscores for module names
   */
  for (p = module_name, end = module_name + talloc_strlen(module_name);
       p < end;
       p++) if (*p == '-') *p = '_';

  if (module_instance_name_from_conf(&inst_name, server_cs) < 0) return -1;

  /*
   *  The module being loaded is the namespace with all '-'
   *  transformed to '_'.
   *
   *  The instance name is the virtual server name.
   */
  mi = module_instance_alloc(process_modules, NULL, DL_MODULE_TYPE_PROCESS,
           module_name, inst_name,
           MODULE_INSTANCE_NONE);
  talloc_free(module_name);
  if (mi == NULL) {
  error:
    cf_log_perr(ci, "Failed loading process module");
    return -1;
  }
  if (unlikely(module_instance_conf_parse(mi, mi->conf) < 0)) {
    talloc_free(mi);
    goto error;
  }

  process = (fr_process_module_t const *)mi->module->exported;
  if (!*(process->dict)) {
    cf_log_err(ci, "Process module is invalid - missing namespace dictionary");
    talloc_free(mi);
    return -1;
  }
  cf_data_add(server_cs, mi, "process_module", false);
  cf_data_add(server_cs, *(process->dict), "dict", false);

  return 0;
}

static inline CC_HINT(always_inline)
int add_compile_list(virtual_server_t *vs, CONF_SECTION *cs, virtual_server_compile_t const *compile_list, char const *name)
{
  int i;
  virtual_server_compile_t const *list = compile_list;

  if (!compile_list) return 0;

  for (i = 0; list[i].section; i++) {
#ifndef NDEBUG
    /*
     *  We can't have a wildcard for name1.  It MUST be a real name.
     *
     *  The wildcard was allowed previously for ideas which later didn't turn out.
     */
    if (list[i].section->name1 == CF_IDENT_ANY) {
      fr_assert(0);
      continue;
    }

#endif
    if (virtual_server_section_register(vs, &list[i]) < 0) {
      cf_log_err(cs, "Failed registering processing section name %s for %s",
           list[i].section->name1, name);
      return -1;
    }
  }

  return 0;
}

/** dl_open a process_* module
 *
 * @param[in] ctx to allocate data in.
 * @param[out] out  Where to our listen configuration.  Is a #fr_virtual_listen_t structure.
 * @param[in] parent  Base structure address.
 * @param[in] ci  #CONF_SECTION containing the listen section.
 * @param[in] rule  unused.
 * @return
 *  - 0 on success.
 *  - -1 on failure.
 */
static int namespace_parse(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *parent, CONF_ITEM *ci, UNUSED conf_parser_t const *rule)
{
  CONF_PAIR   *cp = cf_item_to_pair(ci);
  CONF_SECTION    *server_cs = cf_item_to_section(cf_parent(ci));
  CONF_SECTION    *process_cs;
  virtual_server_t  *server = talloc_get_type_abort(((uint8_t *) out) - offsetof(virtual_server_t, process_mi), virtual_server_t);
  char const    *namespace = cf_pair_value(cp);
  module_instance_t *mi = cf_data_value(cf_data_find(server_cs, module_instance_t, "process_module"));

  /*
   *  We don't have access to virtual_server_t
   *  in the onread callback, so we need to do the
   *  fixups here.
   */
  server->process_mi = mi;
  server->process_module = (fr_process_module_t const *)mi->module->exported;

  *(module_instance_t const **)out = mi;

  /*
   *  Enforce that the protocol process configuration is in
   *  a subsection named for the protocol.  We don't know if
   *  the process code needs this, so we just mark it as
   *  parsed, in order to avoid spurious complaints.
   */
  process_cs = cf_section_find(server_cs, namespace, NULL);
  if (!process_cs) {
    MEM(process_cs = cf_section_alloc(server_cs, server_cs, namespace, NULL));
    cf_item_mark_parsed(process_cs);
  }

  if (module_instance_conf_parse(mi, process_cs) < 0) {
    cf_log_perr(ci, "Failed bootstrapping process module");
    cf_data_remove(server_cs, module_instance_t, "process_module");
    cf_data_remove(server_cs, fr_dict_t, "dict");
    TALLOC_FREE(server->process_mi);
    return -1;
  }

  /*
   *  Pull the list of sections we need to compile out of
   *  the process module's public struct.
   */
  return add_compile_list(server, server->process_mi->conf, server->process_module->compile_list, namespace);
}

/** dl_open a proto_* module
 *
 * @param[in] ctx to allocate data in.
 * @param[out] out  Where to our listen configuration.  Is a #fr_virtual_listen_t structure.
 * @param[in] parent  Base structure address.
 * @param[in] ci  #CONF_SECTION containing the listen section.
 * @param[in] rule  unused.
 * @return
 *  - 0 on success.
 *  - -1 on failure.
 */
static int listen_parse(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *parent, CONF_ITEM *ci, UNUSED conf_parser_t const *rule)
{
  virtual_server_listen_t *listener = talloc_get_type_abort(out, virtual_server_listen_t); /* Pre-allocated for us */
  CONF_SECTION    *listener_cs = cf_item_to_section(ci);
  CONF_SECTION    *server_cs = cf_item_to_section(cf_parent(ci));
  CONF_PAIR   *namespace = cf_pair_find(server_cs, "namespace");

  CONF_PAIR   *cp;
  char const    *module, *name2, *p;
  fr_sbuff_t    *agg;

  module_instance_t *mi;

  fr_cond_assert_msg(proto_modules,
         "virtual_servers_init MUST be called before reading virtual server config");

  if (!namespace) {
    cf_log_err(server_cs, "No 'namespace' set for virtual server");
    cf_log_err(server_cs, "Please add 'namespace = <protocol>' inside of the 'server %s { ... }' section",
         cf_section_name2(server_cs));
    return -1;
  }

  /*
   *  The module we load comes from the 'handler' or 'proto' configuration.  This configuration item
   *  allows us to have multi-protocol listen module, such as "detail".
   *
   *  If there isn't a multi-protocol listen module, then load the one for this namespace, such as
   *  "radius".
   */
  cp = cf_pair_find(listener_cs, "handler");
  if (!cp) cp = cf_pair_find(listener_cs, "proto");
  if (cp) {
    module = cf_pair_value(cp);
    if (!module) {
      cf_log_err(cp, "Missing value");
      return -1;
    }
  } else {
    module = cf_pair_value(namespace);
  }

  /*
   *  The proto modules go into a global tree, so we qualify their name (second name) with the name
   *  of the virtual server, followed by the transport, followed by any transport-specific
   *  configuration.
   */
  FR_SBUFF_TALLOC_THREAD_LOCAL(&agg, 64, MODULE_INSTANCE_LEN_MAX);

  name2 = cf_section_name2(listener_cs);

  /*
   *  A 'listen foo' in this virtual server helps it to be unique.  We load the "radius" module,
   *  instance "default.foo".  This naming scheme is a little counter-intuitive, but it is required
   *  due to the listen module list being global, and loading the leading module name e.g. "radius".
   *
   *  Since the virtual server names are unique, we don't have to qualify the listen section names
   *  by anything else.
   */
  if (name2) {
    /*
     *  We do some duplicate checks here, because that gives better errors than if we use the
     *  mangled names below.
     */
    if (module_instance_name_valid(name2) < 0) {
      cf_log_perr(listener_cs, "Invalid name in 'listen %s'", name2);
      return -1;
    }

    /*
     *  Load "radius", instance "default.foo".
     */
    if ((fr_sbuff_in_char(agg, '.') < 0) || (fr_sbuff_in_strcpy(agg, name2) < 0)) goto name_too_long;
  }

  /*
   *  Further qualify the name by transport and port.  This helps it to be more unique.
   */
  cp = cf_pair_find(listener_cs, "transport");
  if (!cp || ((p = cf_pair_value(cp)) == NULL)) {
    cf_log_err(listener_cs, "Invalid 'listen' section - No 'transport = ...' definition was found.");
    return -1;
  }
  if ((fr_sbuff_in_char(agg, '.') < 0) || (fr_sbuff_in_strcpy(agg, p) < 0)) {
  name_too_long:
    cf_log_err(listener_cs, "Listener name is too long");
    return -1;
  }

  cp = cf_pair_find(listener_cs, "port");
  if (cp && ((p = cf_pair_value(cp)) != NULL)) {
    if ((fr_sbuff_in_char(agg, '.') < 0) || (fr_sbuff_in_strcpy(agg, p) < 0)) goto name_too_long;
  }

  if (module_instance_name_valid(fr_sbuff_start(agg)) < 0) {
    cf_log_perr(listener_cs, "Failed loading listen section.");
    return -1;
  }

  mi = module_instance_alloc(proto_modules, NULL, DL_MODULE_TYPE_PROTO, module, fr_sbuff_start(agg), MODULE_INSTANCE_NONE);
  if (!mi) {
    cf_log_perr(listener_cs, "Failed creating listen section");
    return -1;
  }

  if (unlikely(module_instance_conf_parse(mi, listener_cs) < 0)) {
    talloc_free(mi);
    cf_log_perr(listener_cs, "Failed parsing listen section");
    return -1;
  }

  listener->proto_mi = mi;
  listener->proto_module = (fr_app_t const *)listener->proto_mi->module->exported;
  cf_data_add(listener_cs, mi, "proto_module", false);

  /*
   *  The listener doesn't have to contain a 'type = foo' configuration.  But if it does, there MUST
   *  also be a 'recv foo' section.
   */
  for (cp = cf_pair_find(listener_cs, "type");
       cp != NULL;
       cp = cf_pair_find_next(listener_cs, cp, "type")) {
    char const *type = cf_pair_value(cp);

    if (!type) continue;

    if (!cf_section_find(server_cs, "recv", type)) {
      cf_log_err(cp, "Listener has 'type = %s', but there is no 'recv %s { ... }' section defined.",
           type, type);
      return -1;
    }
  }

  return 0;
}

static fr_cmp_ret_t virtual_server_compile_name_cmp(void const *a, void const *b)
{
  virtual_server_compile_t const *sa = a;
  virtual_server_compile_t const *sb = b;

  return section_name_cmp(sa->section, sb->section);
}

/** Callback to validate the server section
 *
 * @param[in] ctx to allocate data in.
 * @param[out] out  Where to our listen configuration.  Is a #virtual_server_t structure.
 * @param[in] parent  Base structure address.
 * @param[in] ci  #CONF_SECTION containing the listen section.
 * @param[in] rule  unused.
 * @return
 *  - 0 on success.
 *  - -1 on failure.
 */
static int server_parse(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *parent,
      CONF_ITEM *ci, UNUSED conf_parser_t const *rule)
{
  virtual_server_t  *server = talloc_get_type_abort(out, virtual_server_t);
  CONF_SECTION    *server_cs = cf_item_to_section(ci);
  CONF_PAIR   *namespace;

  namespace = cf_pair_find(server_cs, "namespace");
  if (!namespace) {
    cf_log_err(server_cs, "virtual server %s MUST contain a 'namespace' option",
         cf_section_name2(server_cs));
    return -1;
  }

  MEM(server->sections = fr_rb_alloc(server, virtual_server_compile_name_cmp, NULL));
  server->server_cs = server_cs;

  /*
   *  Now parse the listeners
   */
  if (cf_section_parse(out, server, server_cs) < 0) return -1;

  /*
   *  And cache this struct for later referencing.
   */
  cf_data_add(server_cs, server, NULL, false);

  return 0;
}

/** Return the namespace for the named virtual server
 *
 * @param[in] virtual_server  to look for namespace in.
 * @return
 *  - NULL on error.
 *  - Namespace on success.
 */
fr_dict_t const *virtual_server_dict_by_name(char const *virtual_server)
{
  virtual_server_t const *vs;

  vs = virtual_server_find(virtual_server);
  if (!vs) return NULL;

  return virtual_server_dict_by_cs(vs->server_cs);
}

/** Return the namespace for specified CONF_SECTION
 *
 * @param[in] cs    to look for namespace in.
 * @return
 *  - NULL on error.
 *  - Namespace on success.
 */
fr_dict_t const *virtual_server_dict_by_cs(CONF_SECTION const *cs)
{
  CONF_DATA const *cd;
  fr_dict_t *dict;

  cd = cf_data_find(cs, fr_dict_t, "dict");
  if (!cd) return NULL;

  dict = cf_data_value(cd);
  (void) talloc_get_type_abort(dict, fr_dict_t);

  return dict;
}

/** Return the namespace for a given virtual server specified by a CONF_ITEM within the virtual server
 *
 * @param[in] ci    to look for namespace in.
 * @return
 *  - NULL on error.
 *  - Namespace on success.
 */
fr_dict_t const *virtual_server_dict_by_child_ci(CONF_ITEM const *ci)
{
  CONF_DATA const *cd;
  fr_dict_t *dict;

  cd = cf_data_find_in_parent(ci, fr_dict_t, "dict");
  if (!cd) return NULL;

  dict = cf_data_value(cd);
  (void) talloc_get_type_abort(dict, fr_dict_t);

  return dict;
}

/** Verify that a given virtual_server exists and is of a particular namespace
 *
 * Mostly used by modules to check virtual servers specified by their configs.
 *
 * @param[out] out    we found. May be NULL if just checking for existence.
 * @param[in] virtual_server  to check.
 * @param[in] namespace   the virtual server must belong to.
 * @param[in] ci    to log errors against. May be NULL if caller
 *        doesn't want errors logged.
 * @return
 *  - 0 on success.
 *  - -1 if no virtual server could be found.
 *  - -2 if virtual server is not of the correct namespace.
 */
int virtual_server_has_namespace(CONF_SECTION **out,
         char const *virtual_server, fr_dict_t const *namespace, CONF_ITEM *ci)
{
  virtual_server_t const  *vs;
  CONF_SECTION    *server_cs;
  fr_dict_t const   *dict;

  if (out) *out = NULL;

  vs = virtual_server_find(virtual_server);
  if (!vs) {
    if (ci) cf_log_err(ci, "Can't find virtual server \"%s\"", virtual_server);
    return -1;
  }
  server_cs = virtual_server_cs(vs);

  dict = virtual_server_dict_by_name(virtual_server);
  if (!dict) {
    /*
     *  Not sure this is even a valid state?
     */
    if (ci) cf_log_err(ci, "No namespace found in virtual server \"%s\"", virtual_server);
    return -2;
  }

  if (dict != namespace) {
    if (ci) {
      cf_log_err(ci,
           "Expected virtual server \"%s\" to be of namespace \"%s\", got namespace \"%s\"",
           virtual_server, fr_dict_root(namespace)->name, fr_dict_root(dict)->name);
    }
    return -2;
  }

  if (out) *out = server_cs;

  return 0;
}

/*
 *  If we pushed a log destination, we need to pop it.
 */
static unlang_action_t server_remove_log_destination(UNUSED unlang_result_t *p_result,
                 request_t *request, void *uctx)
{
  virtual_server_t *server = uctx;

  request_log_prepend(request, server->log, L_DBG_LVL_DISABLE);

  return UNLANG_ACTION_CALCULATE_RESULT;
}

static void server_signal_remove_log_destination(request_t *request, UNUSED fr_signal_t action, void *uctx)
{
  virtual_server_t *server = uctx;

  request_log_prepend(request, server->log, L_DBG_LVL_DISABLE);
}

/** Push a finally section onto the stack
 *
 * The finally instruction cannot be cancelled and will always execute as the stack is unwound.
 *
 * @param[in] request   request to push the finally section onto.
 * @param[in] vs    virtual server to push the finally section for.
 * @param[in,out] top_frame mutate the top frame value to indicate that future
 *        pushes should be subframes.
 * @return
 *  - 0 on success.
 *  - -1 on failure.
 */
static inline CC_HINT(always_inline) int virtual_server_push_finally(request_t *request, virtual_server_t const *vs, bool *top_frame)
{
  /*
   *  Don't bother finding the packet type unless there
   *  are finally sections registered.
   */
  if (vs->finally_by_packet_type) {
    fr_pair_t *vp = fr_pair_find_by_da(&request->request_pairs, NULL,
               *(vs->process_module->packet_type));
    fr_value_box_t  key;
    void    *instruction;

    if (!vp) goto check_default; /* No packet type found, still allow default finally section */

    if (fr_value_box_cast(NULL, &key, FR_TYPE_UINT16, NULL, &vp->data) < 0) return -1;

    if (key.vb_uint16 >= talloc_array_length(vs->finally_by_packet_type) ||
        !(instruction = vs->finally_by_packet_type[key.vb_uint16])) goto check_default;

    if (unlikely(unlang_finally_push_instruction(request, instruction,
                   fr_time_delta_from_sec(5), *top_frame) < 0)) return -1;

    *top_frame = UNLANG_SUB_FRAME; /* switch to SUB_FRAME after the first instruction */

    return 0;
  }

check_default:
  if (vs->finally_default) {
    if (unlikely(unlang_finally_push_instruction(request, vs->finally_default,
                   fr_time_delta_from_sec(5), *top_frame) < 0)) return -1;

    *top_frame = UNLANG_SUB_FRAME; /* switch to SUB_FRAME after the first instruction */
  }

  return 0;
}

/** Set the request processing function.
 *
 *  Short-term hack
 */
unlang_action_t virtual_server_push(unlang_result_t *p_result, request_t *request, virtual_server_t const *vs, bool top_frame)
{
  /*
   *  Add a log destination specific to this virtual server.
   *
   *  If we add a log destination, make sure to remove it when we walk back up the stack.
   *  But ONLY if we're not at the top of the stack.
   *
   *  When a brand new request comes in, it has a "call" frame pushed, and then this function is
   *  called.  So if we're at the top of the stack, we don't need to pop any logging function,
   *  because the request will die immediately after the top "call" frame is popped.
   *
   *  However, if we're being reached from a "call" frame in the middle of the stack, then
   *  we do have to pop the log destination when we return.
   */
  if (vs->log) {
    request_log_prepend(request, vs->log, fr_debug_lvl);

    if (unlang_interpret_stack_depth(request) > 1) {
      unlang_action_t action;

      action = unlang_function_push_with_result(unlang_interpret_result(request),  /* transparent */
                  request,
                  NULL,         /* don't call it immediately */
                  server_remove_log_destination,  /* but when we pop the frame */
                  server_signal_remove_log_destination, FR_SIGNAL_ALLOW(FR_SIGNAL_CANCEL),
                  top_frame,
                  UNCONST(void *, vs));
      if (action != UNLANG_ACTION_PUSHED_CHILD) return action;

      top_frame = UNLANG_SUB_FRAME; /* switch to SUB_FRAME after the first instruction */
    }
  }

  /*
   *  Push an uncancellable finally instruction to the stack.
   */
  if (virtual_server_push_finally(request, vs, &top_frame) < 0) return UNLANG_ACTION_FAIL;

  /*
   *  Bootstrap the stack with a module instance.
   */
  if (unlang_module_push(p_result, request, vs->process_mi,
             vs->process_module->process, top_frame) < 0) return UNLANG_ACTION_FAIL;

  return UNLANG_ACTION_PUSHED_CHILD;
}

static int cmd_show_server_list(FILE *fp, UNUSED FILE *fp_err, UNUSED void *ctx, UNUSED fr_cmd_info_t const *info)
{
  size_t i, server_cnt = virtual_servers ? talloc_array_length(virtual_servers) : 0;

  if (!server_cnt) return 0;

  for (i = 0; i < server_cnt; i++) {
    fprintf(fp, "%-30snamespace = %s\n", cf_section_name2(virtual_servers[i]->server_cs),
      fr_dict_root(*(virtual_servers[i]->process_module->dict))->name);
  }

  return 0;
}

static fr_cmd_table_t cmd_table[] = {
  {
    .parent = "show",
    .name = "server",
    .help = "Show virtual server settings.",
    .read_only = true,
  },

  {
    .parent = "show server",
    .name = "list",
    .func = cmd_show_server_list,
    .help = "Show the list of virtual servers loaded in the server.",
    .read_only = true,
  },

  CMD_TABLE_END

};

/** Compare listeners by app_io_addr
 *
 *  Only works for IP addresses, and will blow up on file names
 */
static fr_cmp_ret_t listen_addr_cmp(void const *one, void const *two)
{
  fr_listen_instance_t const *a = one;
  fr_listen_instance_t const *b = two;
  fr_ipaddr_t aip, bip;
  int ret;

  /*
   *  The caller must ensure that the address field is set.
   */
  if (!a->app_io_addr && !b->app_io_addr) return CMP_EQ;
  if (!a->app_io_addr && b->app_io_addr) return CMP_LT;
  if (a->app_io_addr && !b->app_io_addr) return CMP_GT;

  /*
   *  Address family
   */
  CMP_RETURN(a, b, app_io_addr->af);

  fr_assert((a->app_io_addr->af == AF_INET) || ((a->app_io_addr->af == AF_INET6)));

  /*
   *  UDP vs TCP
   */
  CMP_RETURN(a, b, app_io_addr->type);

  /*
   *  Check ports.
   */
  CMP_RETURN(a, b, app_io_addr->inet.src_port);

  /*
   *  Don't call fr_ipaddr_cmp(), as we need to do our own
   *  checks here.  We have various wildcard checks which
   *  aren't globally applicable.
   */

  /*
   *  Different address families.
   */
  CMP_RETURN(a, b, app_io_addr->inet.src_ipaddr.af);

  /*
   *  If both are bound to interfaces, AND the interfaces
   *  are different, then there is no conflict.
   */
  if (a->app_io_addr->inet.src_ipaddr.scope_id && b->app_io_addr->inet.src_ipaddr.scope_id) {
    CMP_RETURN(a, b, app_io_addr->inet.src_ipaddr.scope_id);
  }

  ret = a->app_io_addr->inet.src_ipaddr.prefix - b->app_io_addr->inet.src_ipaddr.prefix;
  aip = a->app_io_addr->inet.src_ipaddr;
  bip = b->app_io_addr->inet.src_ipaddr;

  /*
   *  Mask out the longer prefix to match the shorter
   *  prefix.
   */
  if (ret < 0) {
    fr_ipaddr_mask(&bip, a->app_io_addr->inet.src_ipaddr.prefix);

  } else if (ret > 0) {
    fr_ipaddr_mask(&aip, b->app_io_addr->inet.src_ipaddr.prefix);

  }

  return fr_ipaddr_cmp(&aip, &bip);
}

/** See if another global listener is using a particular IP / port
 *
 */
fr_listen_instance_t *listen_find_any(fr_listen_instance_t *li)
{
  fr_listen_instance_t *found;

  if (!listen_addr_root) return NULL;

  fr_rb_find((void **)&found, listen_addr_root, li);

  return found;
}


/**  Record that we're listening on a particular IP / port
 *
 */
bool listen_record(fr_listen_instance_t *li)
{
  if (!listen_addr_root) return false;

  if (!li->app_io_addr) return true;

  if (listen_find_any(li) != NULL) return false;

  return fr_rb_insert(listen_addr_root, li) == 0;
}

/** Return the configuration section for a virtual server
 *
 * @param[in] vs to return conf section for
 * @return
 *  - The CONF_SECTION of the virtual server.
 */
CONF_SECTION *virtual_server_cs(virtual_server_t const *vs)
{
  return vs->server_cs;
}

/** Resolve a CONF_SECTION to a virtual server
 *
 */
virtual_server_t const *virtual_server_from_cs(CONF_SECTION const *server_cs)
{
  virtual_server_t *vs;

  vs = cf_data_value(cf_data_find(server_cs, virtual_server_t, NULL));
  if (!vs) {
    cf_log_err(server_cs, "server_cs does not contain virtual server data");
    return NULL;
  }

  return vs;
}

/** Return virtual server matching the specified name
 *
 * @note May be called in bootstrap or instantiate as all servers should be present.
 *
 * @param[in] name  of virtual server.
 * @return
 *  - NULL if no virtual server was found.
 *  - The CONF_SECTION of the named virtual server.
 */
virtual_server_t const *virtual_server_find(char const *name)
{
  CONF_SECTION *server_cs = cf_section_find(virtual_server_root, "server", name);
  CONF_DATA const *cd;

  if (unlikely(server_cs == NULL)) return NULL;

  cd = cf_data_find(server_cs, virtual_server_t, NULL);
  if (unlikely(cd == NULL)) return NULL;

  return cf_data_value(cd);
}

/** Find a virtual server using one of its sections
 *
 * @param[in] ci  to find parent virtual server for.
 * @return
 *  - The virtual server section on success.
 *  - NULL if the child isn't associated with any virtual server section.
 */
virtual_server_t const *virtual_server_by_child(CONF_ITEM const *ci)
{
  CONF_SECTION *cs;
  CONF_DATA const *cd;

  cs = cf_section_find_parent(ci, "server", CF_IDENT_ANY);
  if (unlikely(!cs)) {
    cf_log_err(ci, "Child section is not associated with a virtual server");
    return NULL;
  }

  cd = cf_data_find(cs, virtual_server_t, NULL);
  if (unlikely(!cd)) {
    cf_log_err(ci, "Virtual server section missing virtual_server_t data");
    return NULL;
  }

  return cf_data_value(cd);
}

/** Return the packet type attribute for a virtual server specified by a config section
 *
 * @param[in] server_cs   to look for packet type attribute in.
 * @return
 *  - NULL on error.
 *  - packet type dict attr on success.
 */
fr_dict_attr_t const *virtual_server_packet_type_by_cs(CONF_SECTION const *server_cs)
{
  virtual_server_t const *vs = virtual_server_from_cs(server_cs);

  if (unlikely(!vs || !vs->process_module || !vs->process_module->packet_type)) return NULL;
  return *vs->process_module->packet_type;
}

/** Wrapper for the config parser to allow pass1 resolution of virtual servers
 *
 */
int virtual_server_cf_parse(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *parent,
          CONF_ITEM *ci, conf_parser_t const *rule)
{
  virtual_server_t const *vs;
  virtual_server_cf_parse_uctx_t const *uctx = rule->uctx;

  vs = virtual_server_find(cf_pair_value(cf_item_to_pair(ci)));
  if (!vs) {
    cf_log_err(ci, "virtual-server \"%s\" not found", cf_pair_value(cf_item_to_pair(ci)));
    return -1;
  }

  /*
   *  Validation checks
   */
  if (uctx) {
    /*
     *  Check the module name
     *
     *  FIXME: ...at some point in the distance future.  Names
     *  are icky, we should compare based on dl_module_t, but
     *  ordering issues make this difficult currently.
     */
    if (uctx->process_module_name) {
      /* catch users doing stupid things */
      if (strcmp(uctx->process_module_name, vs->process_mi->module->name) != 0) {
        cf_log_err(ci, "virtual server \"%s\" must be of type \"%s\", "
             "got type \"%s\"",
             cf_pair_value(cf_item_to_pair(ci)),
             uctx->process_module_name, vs->process_mi->module->name);
        return -1;
      }
    }

    /*
     *  It's theoretically possible for the same module to be used
     *  with multiple namespaces, so we need this check too.
     */
    if (uctx->required_dict) {
      fr_dict_t *required_dict = *uctx->required_dict;

      if (!fr_cond_assert_msg(required_dict != NULL,
            "dict not resolved before virtual server reference")) {
        return -1;
      }

      if (required_dict != *vs->process_module->dict) {
        cf_log_err(ci, "virtual server \"%s\" must use namespace \"%s\", "
             "got namespace \"%s\"",
             cf_pair_value(cf_item_to_pair(ci)),
             fr_dict_root(required_dict)->name,
             fr_dict_root(*vs->process_module->dict)->name);
        return -1;
      }
    }
  }

  *((virtual_server_t const **)out) = vs;

  return 0;
}

static inline CC_HINT(always_inline) int virtual_server_compile_finally_sections(virtual_server_t *vs, tmpl_rules_t const *rules, int *found)
{
  static unlang_mod_actions_t const mod_actions_finally = {
    .actions = {
      [RLM_MODULE_REJECT] = MOD_PRIORITY_3,
      [RLM_MODULE_FAIL] = MOD_PRIORITY_1,
      [RLM_MODULE_OK]   = MOD_PRIORITY_4,
      [RLM_MODULE_HANDLED]  = MOD_ACTION_RETURN,
      [RLM_MODULE_INVALID]  = MOD_PRIORITY_2,
      [RLM_MODULE_DISALLOW] = MOD_PRIORITY_5,
      [RLM_MODULE_NOTFOUND] = MOD_PRIORITY_6,
      [RLM_MODULE_NOOP] = MOD_PRIORITY_8,
      [RLM_MODULE_UPDATED]  = MOD_PRIORITY_7
    },
    .retry = RETRY_INIT,
  };

  fr_dict_attr_t const  *da;
  fr_dict_attr_t const  **da_p = vs->process_module->packet_type;
  CONF_SECTION    *subcs;

  if (!da_p || !*da_p) {
    subcs = cf_section_find(vs->server_cs, "finally", CF_IDENT_ANY);
    if (!subcs) return 0;

    cf_log_err(subcs, "Invalid 'finally' section - virtual server does not define a 'packet_type'");
    return -1;
  }

  da = *da_p;

  /*
   *  Iterate over all the finally sections, trying to resolve
   *  the name2 to packet types.
   */
  for (subcs = cf_section_find(vs->server_cs, "finally", CF_IDENT_ANY);
       subcs;
       subcs = cf_section_find_next(vs->server_cs, subcs, "finally", CF_IDENT_ANY)) {
    char const      *packet_type = cf_section_name2(subcs);
    fr_dict_enum_value_t const  *ev;
    fr_value_box_t      key;
    int       ret;
    void        *instruction;

    if (!packet_type) {
      if (vs->finally_default) {
        cf_log_err(subcs, "Duplicate 'finally { ... }' section");
        return -1;
      }

      ret = unlang_compile(vs, subcs, &mod_actions_finally, rules, &instruction);
      if (ret < 0) return -1;

      vs->finally_default = instruction;
      (*found)++;

      continue;
    }

    /*
     *  FIXME: This would allow response packet types too
     *  We don't have anything that lists request/response
     *  types, so we can't check that here.
     */
    ev = fr_dict_enum_by_name(da, packet_type, talloc_strlen(packet_type));
    if (!ev) {
      cf_log_err(subcs, "Invalid 'finally %s { ... }' section, "
          "does not match any Packet-Type value", packet_type);
      return -1;
    }

    /*
     *  This is... unlikely, as protocols usually use small
     *  packet types.
     */
    if (!fr_type_is_integer_except_bool(ev->value->type)) {
    forbid:
      fr_assert(da);
      cf_log_err(subcs, "'finally %s { ... }' section, "
           "not supported for this protocol.  %s is a %s", packet_type,
           da->name, fr_type_to_str(ev->value->type));
      return -1;
    }

    if (fr_value_box_cast(NULL, &key, FR_TYPE_UINT16, NULL, ev->value) < 0) {
      goto forbid;
    }

    if (key.vb_uint16 >= talloc_array_length(vs->finally_by_packet_type)) {
      MEM(vs->finally_by_packet_type = talloc_realloc_zero(vs, vs->finally_by_packet_type,
                       void *, key.vb_uint16 + 1));
    }

    if (vs->finally_by_packet_type[key.vb_uint16]) {
      cf_log_err(subcs, "Duplicate 'finally %s { ... }' section", packet_type);
      return -1;
    }

    ret = unlang_compile(vs, subcs, &mod_actions_finally, rules, &instruction);
    if (ret < 0) return -1;

    vs->finally_by_packet_type[key.vb_uint16] = instruction;

    (*found)++;
  }

  return 0;
}

/*
 *  Check for 'send FOO' and 'recv BAR' which are unused.
 */
static bool virtual_server_warn_unused(CONF_SECTION *server, virtual_server_compile_t const *list)
{
  bool fail = false;

  cf_section_foreach(server, subcs) {
    char const *name, *name2;

    if (cf_item_is_parsed(subcs)) continue;

    name = cf_section_name1(subcs);

    /*
     *  Allow them to "comment out" an entire block by prefixing the name with "-", ala
     *  "-sql".
     */
    if (*name == '-') continue;

    /*
     *  Local clients are parsed by the listener after the virtual server is bootstrapped.  So
     *  we just ignore them here.
     */
    if (strcmp(name, "client") == 0) continue;

    name2 = cf_section_name2(subcs);

    /*
     *  When checking the configuration, it is an error to have an unused "send FOO" or "recv
     *  BAR" section.
     */
    if (check_config && ((strcmp(name, "recv") == 0) || (strcmp(name, "send") == 0))) {
      if (!name2) {
        cf_log_err(subcs, "Unused processing section' %s {'", name);
        cf_log_err(subcs, "If this is intentional, please rename it to '-%s { ...'", name);
      } else {
        cf_log_err(subcs, "Unused processing section '%s %s {'", name, name2);
        cf_log_err(subcs, "If this is intentional, please rename it to '-%s %s { ...'",
             name, name2);
      }

      fail = true;
      continue;
    }

    /*
     *  Print warnings if it's unused.  If there's an issue with case sensitivity, then that's
     *  an error, even if we're not running check_config.
     */
    name2 = cf_section_name2(subcs);
    if (!name2) {
      cf_log_warn(subcs, "Ignoring '%s {' - it is unused", name);

    } else if (list) {
      int i;
      const char *realname = NULL;

      /*
       *  See if it's a case-sensitive issue.
       *
       *  The dictionaries are case insensitive.  The configuration files are
       *  case sensitive.
       */
      for (i = 0; list[i].section; i++) {
        if (list[i].section->name2 == CF_IDENT_ANY) continue;

        if (strcasecmp(list[i].section->name2, name2) == 0) {
          realname = list[i].section->name2;
          break;
        }
      }

      if (realname) {
        cf_log_err(subcs, "Unused processing section '%s %s {'", name, name2);
        cf_log_err(subcs, "Do you mean '%s %s { ...' ? ", name, realname);
        fail = true;
        break;
      }

      cf_log_warn(subcs, "Ignoring %s %s { - it is unused", name, name2);
    }
  }

  return fail;
}

/** Compile sections for a virtual server.
 *
 *  When the "proto_foo" module calls fr_app_process_instantiate(), it
 *  loads the compile list from the #fr_app_worker_t, and calls this
 *  function.
 *
 *  This function walks down the registration table, compiling each
 *  named section.
 *
 * @param[in] vs  to compile sections for.
 * @param[in] rules to apply for pass1.
 */
static int virtual_server_compile_sections(virtual_server_t *vs, tmpl_rules_t const *rules)
{
  virtual_server_compile_t const  *list = vs->process_module->compile_list;
  void        *instance = vs->process_mi->data;
  CONF_SECTION      *server = vs->server_cs;
  int       i, found;
  bool        fail;
  CONF_SECTION      *subcs = NULL;
  char const      *name, *name2;

  found = 0;

  /*
   *  Complain about v3 things being used in v4.
   *
   *  Don't complain when running in normal mode, because the server will just ignore the new
   *  sections.  But the check_config stuff is generally run before the service starts, and we
   *  definitely want to tell people when running in debug mode.
   */
  if (check_config || DEBUG_ENABLED) {
    fail = false;

    while ((subcs = cf_section_next(server, subcs)) != NULL) {
      if (cf_section_name2(subcs) != NULL) continue;

      name = cf_section_name1(subcs);
      if ((strcmp(name, "authorize") == 0) ||
          (strcmp(name, "authenticate") == 0) ||
          (strcmp(name, "post-auth") == 0) ||
          (strcmp(name, "preacct") == 0) ||
          (strcmp(name, "accounting") == 0) ||
          (strcmp(name, "pre-proxy") == 0) ||
          (strcmp(name, "post-proxy") == 0)) {
        cf_log_err(subcs, "Version 3 processing section '%s' is not valid in version 4.",
             name);
        fail = true;
      }
    }

    /*
     *  Complain about _all_ of the sections, and not just the first one.
     */
    if (fail) return -1;
  }

  /*
   *  The sections are in trees, so this isn't as bad as it
   *  looks.  It's not O(n^2), but O(n logn).  But it could
   *  still be improved.
   */
  for (i = 0; list[i].section; i++) {
    int rcode;
    CONF_SECTION *bad;

    /*
     *  We are looking for a specific subsection.
     *  Warn if it isn't found, or compile it if
     *  found.
     */
    if (list[i].section->name2 != CF_IDENT_ANY) {
      void *instruction = NULL;

      subcs = cf_section_find(server, list[i].section->name1, list[i].section->name2);
      if (!subcs) {
        DEBUG3("Warning: Skipping %s %s { ... } as it was not found.",
               list[i].section->name1, list[i].section->name2);
        /*
         *  Initialise CONF_SECTION pointer for missing section
         */
        if ((instance) && !list[i].dont_cache) {
          *(CONF_SECTION **) (((uint8_t *) instance) + list[i].offset) = NULL;
        }
        continue;
      }

      /*
       *  Duplicate sections are forbidden.
       */
      bad = cf_section_find_next(server, subcs, list[i].section->name1, list[i].section->name2);
      if (bad) {
      forbidden:
        cf_log_err(bad, "Duplicate sections are forbidden.");
        cf_log_err(subcs, "Previous definition occurs here.");
        return -1;
      }

      rcode = unlang_compile(vs, subcs, list[i].actions, rules, &instruction);
      if (rcode < 0) return -1;

      /*
       *  Cache the CONF_SECTION which was found.
       */
      if (instance) {
        if (!list[i].dont_cache) {
          *(CONF_SECTION **) (((uint8_t *) instance) + list[i].offset) = subcs;
        }
        if (list[i].instruction > 0) {
          *(void **) (((uint8_t *) instance) + list[i].instruction) = instruction;
        }
      }

      found++;
      continue;
    }

    /*
     *  Reset this so that we start from the beginning
     *  again, instead of starting from the last "send
     *  foo" block.
     */
    subcs = NULL;

    /*
     *  Find all subsections with the given first name
     *  and compile them.
     */
    while ((subcs = cf_section_find_next(server, subcs, list[i].section->name1, CF_IDENT_ANY))) {
      name2 = cf_section_name2(subcs);
      if (!name2) {
        cf_log_err(subcs, "Invalid '%s { ... }' section, it must have a name", list[i].section->name1);
        return -1;
      }

      /*
       *  Duplicate sections are forbidden.
       */
      bad = cf_section_find_next(server, subcs, list[i].section->name1, name2);
      if (bad) goto forbidden;

      rcode = unlang_compile(vs, subcs, list[i].actions, rules, NULL);
      if (rcode < 0) return -1;

      /*
       *  Note that we don't store the
       *  CONF_SECTION here, as it's a wildcard.
       *
       *  @todo - count number of subsections
       *  and store them in an array?
       */
      found++;
    }
  }

  /*
   *  Compile finally sections, these are special
   *  sections and always execute before the request
   *  exits from the virtual server.
   */
  if (unlikely(virtual_server_compile_finally_sections(vs, rules, &found) < 0)) {
    cf_log_err(server, "Failed to compile finally sections");
    return -1;
  }

  /*
   *  Didn't find any processing sections.  Note that we don't count "finally" sections here.  They
   *  are only run after the packet has been processed through the normal sections.  A virtual
   *  server with only a "finally" section doesn't make sense.
   *
   *  i.e. if people want to accept packets without responding, they need a "recv foo" section which
   *  contains a "do_not_respond" policy.
   */
  if (!found) {
    cf_log_err(server, "No processing sections are defined for this virtual server");
    cf_log_err(server, "The server WILL NOT be able to process packets until the configuration is fixed");
    return -1;
  }

  if (!check_config && !DEBUG_ENABLED) return found;

  fail = virtual_server_warn_unused(server, list);

  /*
   *  Be nice to people, and complaining about ALL unused processing sections.  That way they don't
   *  have to run the server many, many, times to see all of the errors.
   */
  if (fail) return -1;

  return found;
}

/** Register name1 / name2 as allowed processing sections
 *
 *  This function is called from the virtual server bootstrap routine,
 *  which happens before module_bootstrap();
 */
int virtual_server_section_register(virtual_server_t *vs, virtual_server_compile_t const *entry)
{
  virtual_server_compile_t *old;

  fr_rb_find((void **)&old, vs->sections, entry);
  if (old) return 0;

#ifndef NDEBUG
  /*
   *  Catch stupid programmers.
   *
   *  Processing sections can't allow "*" for module
   *  methods, because otherwise you would be allowed to run
   *  DHCP things in a RADIUS accounting section.  And that
   *  would be bad.
   */
  if (entry->methods) {
    int i;

    for (i = 0; entry->methods[i]; i++) {
      if (entry->methods[i]->name1 == CF_IDENT_ANY) {
        ERROR("Processing sections cannot allow \"*\"");
        return -1;
      }

      if (entry->methods[i]->name2 == CF_IDENT_ANY) {
        ERROR("Processing sections cannot allow \"%s *\"",
          entry->methods[i]->name1);
        return -1;
      }
    }
  }
#endif

  if (fr_rb_insert(vs->sections, entry) != 0) {
    fr_strerror_const("Failed inserting entry into internal tree");
    return -1;
  }

  return 0;
}

/** Find the component for a section
 *
 */
section_name_t const **virtual_server_section_methods(virtual_server_t const *vs, section_name_t const *section)
{
  virtual_server_compile_t *entry;

  /*
   *  Look up the specific name first.  That way we can
   *  define both "accounting on", and "accounting *".
   */
  if (section->name2 != CF_IDENT_ANY) {
    fr_rb_find((void **)&entry, vs->sections,
         &(virtual_server_compile_t) {
        .section = section
         });
    if (entry) return entry->methods;
  }

  /*
   *  Then look up the wildcard, if we didn't find any matching name2.
   */
  fr_rb_find((void **)&entry, vs->sections,
       &(virtual_server_compile_t) {
      .section = SECTION_NAME(section->name1, CF_IDENT_ANY)
       });
  if (!entry) return NULL;

  return entry->methods;
}

/** Define a values for Auth-Type attributes by the sections present in a virtual-server
 *
 * The.name2 value of any sections found will be converted into values of the specified da.
 *
 * @param[in] server_cs   The virtual server containing the sections.
 * @param[in] subcs_name  of the subsection to search for.
 * @param[in] da    to add enumeration values for.
 * @return
 *  - 0 all values added successfully.
 *  - -1 an error occurred.
 */
int virtual_server_section_attribute_define(CONF_SECTION *server_cs, char const *subcs_name, fr_dict_attr_t const *da)
{
  int     rcode = 0;
  CONF_SECTION    *subcs = NULL;

  fr_assert(strcmp(cf_section_name1(server_cs), "server") == 0);

  while ((subcs = cf_section_find_next(server_cs, subcs, subcs_name, CF_IDENT_ANY))) {
    char const  *name2;
    fr_dict_enum_value_t const  *dv;

    name2 = cf_section_name2(subcs);
    if (!name2) {
      cf_log_err(subcs, "Invalid '%s { ... }' section, it must have a name", subcs_name);
      return -1;
    }

    /*
     *  If the value already exists, don't
     *  create it again.
     */
    dv = fr_dict_enum_by_name(da, name2, -1);
    if (dv) continue;

    cf_log_debug(subcs, "Creating %s = %s", da->name, name2);

    /*
     *  Create a new unique value with a meaningless
     *  number.  You can't look at it from outside of
     *  this code, so it doesn't matter.  The only
     *  requirement is that it's unique.
     */
    if (fr_dict_enum_add_name_next(fr_dict_attr_unconst(da), name2) < 0) {
      PERROR("Failed adding section value");
      return -1;
    }

    rcode = 1;
  }

  return rcode;
}

static int define_server_values(CONF_SECTION *cs, fr_dict_attr_t *parent)
{
  char const *ref;
  fr_dict_attr_t const *da;
  CONF_ITEM *ci = NULL;

  ref = cf_section_name2(cs);
  if (!ref) {
    cf_log_err(cs, "Expected 'values <name> { ... }'");
    return -1;
  }

  da = fr_dict_attr_by_name(NULL, parent, ref);
  if (!da) {
    cf_log_err(cs, "No such attribute \"%s\"", ref);
    return -1;
  }

  if (fr_type_is_structural(da->type)) {
    cf_log_err(cs, "Cannot define value for structural attribute \"%s\"", ref);
    return -1;
  }

  /*
   *  This both does not make any sense, and does not get
   *  parsed correctly if the string contains backslashes.
   */
  if (da->type == FR_TYPE_STRING) {
    cf_log_err(cs, "Cannot define value for 'string' attribute \"%s\"", ref);
    return -1;
  }

  while ((ci = cf_item_next(cs, ci))) {
    fr_slen_t slen;
    ssize_t len;
    char const *attr, *value;
    CONF_PAIR *cp;
    fr_dict_enum_value_t const *dv;
    fr_value_box_t box;

    if (cf_item_is_section(ci)) {
      cf_log_err(ci, "Unexpected subsection");
      return -1;
    }

    if (!cf_item_is_pair(ci)) continue;

    cp = cf_item_to_pair(ci);
    fr_assert(cp != NULL);

    /*
     *  =* is a hack by the cf parser to say "no operator"
     */
    if ((cf_pair_operator(cp) != T_OP_EQ) ||
        (cf_pair_attr_quote(cp) != T_BARE_WORD)) {
      cf_log_err(ci, "Definition is not in 'name = value' format");
      return -1;
    }

    attr = cf_pair_attr(cp);
    value = cf_pair_value(cp);

    dv = fr_dict_enum_by_name(da, attr, talloc_strlen(attr));
    if (dv) {
      cf_log_err(cp, "Duplicate value name");
      return -1;
    }

    fr_value_box_init_null(&box);

    len = talloc_strlen(value);

    /*
     *  @todo - unescape for double quoted strings.  Whoops.
     */
    slen = fr_value_box_from_str(NULL, &box, da->type, da, value, len, NULL);
    if (slen < 0) {
      cf_log_err(cp, "Failed parsing value - %s", fr_strerror());
      return -1;
    }

    if (slen != len) {
      cf_log_err(cp, "Unexpected text after value");
      fr_value_box_clear(&box);
      return -1;
    }

    if (fr_dict_enum_add_name(UNCONST(fr_dict_attr_t *, da), attr, &box, false, false) < 0) {
      cf_log_err(cp, "Failed adding value - %s", fr_strerror());
      fr_value_box_clear(&box);
      return -1;
    }

    fr_value_box_clear(&box);
  }

  return 0;
}


static int define_server_attrs(CONF_SECTION *cs, fr_dict_t *dict, fr_dict_attr_t *parent, fr_dict_attr_t const *root)
{
  CONF_ITEM *ci = NULL;

  fr_dict_attr_flags_t flags = {
    .internal = true,
    .name_only = true,
    .local = true,
  };

  fr_assert(dict != NULL);
  fr_assert(parent != NULL);

  while ((ci = cf_item_next(cs, ci))) {
    fr_type_t type;
    char const *attr, *value;
    CONF_PAIR *cp;
    CONF_SECTION *subcs = NULL;

    if (cf_item_is_section(ci)) {
      subcs = cf_item_to_section(ci);
      fr_assert(subcs != NULL);

      attr = cf_section_name1(subcs);

      if (strcmp(attr, "values") == 0) {
        if (define_server_values(subcs, parent) < 0) return -1;
        continue;
      }

      if (strcmp(attr, "tlv") != 0) goto invalid_type;

      value = cf_section_name2(subcs);
      if (!value) {
        cf_log_err(ci, "Definition is not in 'tlv name { ... }' format");
        return -1;
      }

      type = FR_TYPE_TLV;
      goto check_for_dup;
    }

    if (!cf_item_is_pair(ci)) continue;

    cp = cf_item_to_pair(ci);
    fr_assert(cp != NULL);

    /*
     *  =* is a hack by the cf parser to say "no operator"
     */
    if ((cf_pair_operator(cp) != T_OP_CMP_TRUE) ||
        (cf_pair_attr_quote(cp) != T_BARE_WORD) ||
        (cf_pair_value_quote(cp) != T_BARE_WORD)) {
      cf_log_err(ci, "Definition is not in 'type name' format");
      return -1;
    }

    attr = cf_pair_attr(cp);
    value = cf_pair_value(cp);

    type = fr_table_value_by_str(fr_type_table, attr, FR_TYPE_NULL);
    if (type == FR_TYPE_NULL) {
    invalid_type:
      cf_log_err(ci, "Invalid data type '%s'", attr);
      return -1;
    }

    /*
     *  Leaf and group are OK.  TLV, Vendor, Struct, VSA, etc. are not as variable definitions.
     */
    if (!(fr_type_is_leaf(type) || (type == FR_TYPE_GROUP))) goto invalid_type;

    /*
     *  No duplicates are allowed.
     */
  check_for_dup:
    if (root && (fr_dict_attr_by_name(NULL, root, value) != NULL)) {
      cf_log_err(ci, "Local variable '%s' duplicates a dictionary attribute.", value);
      return -1;
    }

    if (fr_dict_attr_by_name(NULL, parent, value) != NULL) {
      cf_log_err(ci, "Local variable '%s' duplicates a previous local attribute.", value);
      return -1;
    }

    if (fr_dict_attr_add_name_only(dict, parent, value, type, &flags) < 0) {
      cf_log_err(ci, "Failed adding local variable '%s' - %s", value, fr_strerror());
      return -1;
    }

    if (type == FR_TYPE_TLV) {
      fr_dict_attr_t const *da;

      if (!subcs) return -1; /* shouldn't happen, but shut up compiler */

      da = fr_dict_attr_by_name(NULL, parent, value);
      fr_assert(da != NULL);

      if (define_server_attrs(subcs, dict, UNCONST(fr_dict_attr_t *, da), NULL) < 0) return -1;
    }
  }

  return 0;
}

static fr_dict_t const *virtual_server_local_dict(CONF_SECTION *server_cs, fr_dict_t const *dict_def)
{
  fr_dict_t *dict;
  CONF_SECTION *cs;

  cs = cf_section_find(server_cs, "dictionary", NULL);
  if (!cs) return dict_def;

  dict = fr_dict_protocol_alloc(dict_def);
  if (!dict) {
    cf_log_err(cs, "Failed allocating local dictionary");
    return NULL;
  }

  if (define_server_attrs(cs, dict, UNCONST(fr_dict_attr_t *, fr_dict_root(dict)), fr_dict_root(dict_def)) < 0){
    talloc_free(dict);
    return NULL;
  }

  /*
   *  Replace the original dictionary with the new one.
   */
  cf_data_remove(server_cs, fr_dict_t, "dict");
  cf_data_add(server_cs, dict, "dict", false);
  cf_item_mark_parsed(cs);

  return dict;
}


/** Open all the listen sockets
 *
 * @param[in] sc  Scheduler to add I/O paths to.
 * @return
 *  - 0 on success.
 *  - -1 on failure.
 */
int virtual_servers_open(fr_schedule_t *sc)
{
  size_t i, server_cnt = virtual_servers ? talloc_array_length(virtual_servers) : 0;
  int opened = 0;

  fr_assert(virtual_servers);

  DEBUG2("#### Opening listener interfaces ####");
  fr_strerror_clear();

  for (i = 0; i < server_cnt; i++) {
    virtual_server_listen_t **listeners;
    size_t      j, listener_cnt;

    listeners = virtual_servers[i]->listeners;
    if (!listeners) continue; /* servers can have no listeners */

    listener_cnt = talloc_array_length(listeners);

    for (j = 0; j < listener_cnt; j++) {
      int ret;
      virtual_server_listen_t *listener = listeners[j];

      fr_assert(listener != NULL);
      fr_assert(listener->proto_mi != NULL);
      fr_assert(listener->proto_module != NULL);

      fr_assert(listener->proto_module->open != NULL);

      /*
       *  The socket is opened with app_instance,
       *  but all subsequent calls (network.c, etc.) use app_io_instance.
       *
       *  The reason is that we call (for example) proto_radius to
       *  open the socket, and proto_radius is responsible for setting up
       *  proto_radius_udp, and then calling proto_radius_udp->open.
       *
       *  Even then, proto_radius usually calls fr_master_io_listen() in order
       *  to create the fr_listen_instance_t structure.
       */

      /*
       *  Sometimes the open function needs to modify instance
       *  data, so we need to temporarily remove the protection.
       */
      module_instance_data_unprotect(listener->proto_mi);
      ret = listener->proto_module->open(listener->proto_mi->data, sc,
                 listener->proto_mi->conf);
      module_instance_data_protect(listener->proto_mi);
      if (unlikely(ret < 0)) {
        return -1;
      }

      opened++;

      /*
       *  Socket information is printed out by
       *  the socket handlers.  e.g. proto_radius_udp
       */
      DEBUG3("Opened listener for %s", listener->proto_module->common.name);
    }
  }

  if (!opened) {
    ERROR("There are no 'listen' sections defined.");
    ERROR("Refusing to start, as the server will never process any packets.");
    return -1;
  }

  return 0;
}

/** Free thread-specific data for all process modules and listeners
 *
 */
void virtual_servers_thread_detach(void)
{
  modules_thread_detach(proto_modules);
  modules_thread_detach(process_modules);
}

/** Perform thread instantiation for all process modules and listeners
 *
 */
int virtual_servers_thread_instantiate(TALLOC_CTX *ctx, fr_event_list_t *el)
{
  if (modules_thread_instantiate(ctx, process_modules, el) < 0) return -1;
  if (modules_thread_instantiate(ctx, proto_modules, el) < 0) {
    modules_thread_detach(process_modules);
    return -1;
  }
  return 0;
}

/** Instantiate all the virtual servers
 *
 * @return
 *  - 0 on success.
 *  - -1 on failure.
 */
int virtual_servers_instantiate(void)
{
  size_t  i, server_cnt;
  CONF_SECTION *cs;
  fr_rb_iter_inorder_t iter;

  /*
   *  User didn't specify any "server" sections
   */
  if (unlikely(!virtual_servers)) {
    ERROR("No virtual servers configured");
    return -1;
  }

  server_cnt = talloc_array_length(virtual_servers);

  DEBUG2("#### Instantiating listeners ####");

  if (fr_command_register_hook(NULL, NULL, virtual_server_root, cmd_table) < 0) {
    PERROR("Failed registering radmin commands for virtual servers");
    return -1;
  }

  for (i = 0; i < server_cnt; i++) {
    CONF_SECTION      *server_cs = virtual_servers[i]->server_cs;
    fr_dict_t const     *dict;
    virtual_server_t    *vs = virtual_servers[i];
    fr_process_module_t const *process = (fr_process_module_t const *)
                  vs->process_mi->module->exported;

    /*
     *  Set up logging before doing anything else.
     */
    if (vs->log_name) {
      vs->log = log_dst_by_name(vs->log_name);
      if (!vs->log) {
        CONF_PAIR *cp = cf_pair_find(server_cs, "log");

        if (cp) {
          cf_log_err(cp, "Unknown log destination '%s'", vs->log_name);
        } else {
          cf_log_err(server_cs, "Unknown log destination '%s'", vs->log_name);
        }

        return -1;
      }
    }

    dict = virtual_server_local_dict(server_cs, *(process)->dict);
    if (!dict) return -1;

    DEBUG("Compiling policies in server %s { ... }", cf_section_name2(server_cs));

    fr_assert(virtual_servers[i]->process_mi);

    /*
     *  Compile the processing sections indicated by
     *      the process module.  This must be done before
     *  module_instantiate is called, as the instance
     *  data is protected after this call.
     */
    if (process->compile_list) {
      tmpl_rules_t    parse_rules = {
        .attr = {
          .dict_def = dict,
          .list_def = request_attr_request,
        },

        .literals_safe_for = FR_VALUE_BOX_SAFE_FOR_ANY,
      };

      fr_assert(parse_rules.attr.dict_def != NULL);

      if (virtual_server_compile_sections(virtual_servers[i], &parse_rules) < 0) {
        return -1;
      }
    }

    (void) virtual_server_warn_unused(server_cs, process->compile_list);
  }

  /*
   *  Iterate over virtual modules to see if we can compile them.
   */
  for (cs = module_rlm_virtual_iter_init(&iter);
       cs != NULL;
       cs = module_rlm_virtual_iter_next(&iter)) {
    fr_dict_t const *dict;

    dict = virtual_server_dict_by_cs(cs); /* cheating! */
    if (!dict) continue;

    if (unlang_compile_virtual_module(cs, dict) < 0) return -1;
  }

  if (modules_instantiate(process_modules) < 0) {
    PERROR("Failed instantiating process modules");
    return -1;
  }
  if (modules_instantiate(proto_modules) < 0) {
    PERROR("Failed instantiating protocol modules");
    return -1;
  }

  return 0;
}

/** Load protocol modules and call their bootstrap methods
 *
 * @param[in] config  section containing the virtual servers to bootstrap.
 * @return
 *  - 0 on success.
 *  - -1 on failure.
 */
int virtual_servers_bootstrap(CONF_SECTION *config)
{
  virtual_server_root = config;

  /*
   *  Ensure any libraries the modules depend on are instantiated
   */
  if (global_lib_instantiate() < 0) return -1;

  if (modules_bootstrap(process_modules) < 0) {
    PERROR("Failed bootstrapping process modules");
    return -1;
  }
  if (modules_bootstrap(proto_modules) < 0) {
    PERROR("Failed bootstrapping protocol modules");
    return -1;
  }

  return 0;
}

int virtual_servers_free(void)
{
  if (talloc_free(listen_addr_root) < 0) return -1;
  listen_addr_root = NULL;
  if (talloc_free(process_modules) < 0) return -1;
  process_modules = NULL;
  if (talloc_free(proto_modules) < 0) return -1;
  proto_modules = NULL;
  if (fr_dict_autofree(virtual_server_dict_autoload) < 0) return -1;

  return 0;
}

static int _virtual_servers_atexit(UNUSED void *uctx)
{
  return virtual_servers_free();
}

/** Performs global initialisation for the virtual server code
 *
 * This has to be done separately and explicitly, because the above code makes
 * use of "onread" callbacks.
 *
 * Will automatically free module lists on exit, but all modules should have
 * been removed from this list by the point that happens.
 */
int virtual_servers_init(void)
{
  if (fr_dict_autoload(virtual_server_dict_autoload) < 0) {
    PERROR("%s", __FUNCTION__);
    return -1;
  }
  if (fr_dict_attr_autoload(virtual_server_dict_attr_autoload) < 0) {
    PERROR("%s", __FUNCTION__);
    fr_dict_autofree(virtual_server_dict_autoload);
    return -1;
  }

  MEM(process_modules = module_list_alloc(NULL, &module_list_type_global, "process", true));

  /*
   *  FIXME - We should be able to turn on write protection,
   *  but there are too many proto modules that hang things
   *  off of their instance data.
   */
  MEM(proto_modules = module_list_alloc(NULL, &module_list_type_global, "protocol", false));
  MEM(listen_addr_root = fr_rb_inline_alloc(NULL, fr_listen_instance_t, virtual_server_node, listen_addr_cmp,
              NULL));

  /*
   *  Create a list to hold all the proto_* modules
   *  that get loaded during startup.
   */
  fr_atexit_global(_virtual_servers_atexit, NULL);

  return 0;
}

Coverage Report

Created: 2026-11-12 06:42