///////////////////////////////////////////////////////////////////////////////
//
// Copyright (c) 2000, Microsoft Corp. All rights reserved.
//
// FILE
//
//    radprxy.cpp
//
// SYNOPSIS
//
//    Defines the reusable RadiusProxy engine. This should have no IAS specific
//    dependencies.
//
// MODIFICATION HISTORY
//
//    02/08/2000    Original version.
//    05/30/2000    Eliminate QUESTIONABLE state.
//
///////////////////////////////////////////////////////////////////////////////

#include <proxypch.h>
#include <radproxyp.h>
#include <radproxy.h>

// Avoid dependencies on ntrtl.h
extern "C" ULONG __stdcall RtlRandom(PULONG seed);

// Extract a 32-bit integer from a buffer.
ULONG ExtractUInt32(const BYTE* p) throw ()
{
   return (ULONG)(p[0] << 24) | (ULONG)(p[1] << 16) |
          (ULONG)(p[2] <<  8) | (ULONG)(p[3]      );
}

// Insert a 32-bit integer into a buffer.
void InsertUInt32(BYTE* p, ULONG val) throw ()
{
   *p++ = (BYTE)(val >> 24);
   *p++ = (BYTE)(val >> 16);
   *p++ = (BYTE)(val >>  8);
   *p   = (BYTE)(val      );
}

//
//  Layout of a Microsoft State attribute
//
//  struct MicrosoftState
//  {
//      BYTE checksum[4];
//      BYTE vendorID[4];
//      BYTE version[2];
//      BYTE serverAddress[4];
//      BYTE sourceID[4];
//      BYTE sessionID[4];
//  };
//

// Extracts the creators address from a State attribute or INADDR_NONE if this
// isn't a valid Microsoft State attributes.
ULONG ExtractAddressFromState(const RadiusAttribute& state) throw ()
{
   if (state.length == 22 &&
       !memcmp(state.value + 4, "\x00\x00\x01\x37\x00\x01", 6) &&
       IASAdler32(state.value + 4, 18) == ExtractUInt32(state.value))
   {
      return ExtractUInt32(state.value + 10);
   }

   return INADDR_NONE;
}

// Returns true if this is an Accounting-On/Off packet.
bool IsNasStateRequest(const RadiusPacket& packet) throw ()
{
   const RadiusAttribute* status = FindAttribute(
                                       packet,
                                       RADIUS_ACCT_STATUS_TYPE
                                       );
   if (!status) { return false; }

   ULONG value = ExtractUInt32(status->value);

   return value == 7 || value == 8;
}

RemotePort::RemotePort(
                ULONG ipAddress,
                USHORT port,
                PCSTR sharedSecret
                )
   : address(ipAddress, port),
     secret((const BYTE*)sharedSecret, strlen(sharedSecret))
{
}

RemotePort::RemotePort(const RemotePort& port)
   : address(port.address),
     secret(port.secret),
     nextIdentifier(port.nextIdentifier)
{
}

RemoteServer::RemoteServer(
                  const RemoteServerConfig& config
                  )
   : guid(config.guid),
     authPort(config.ipAddress, config.authPort, config.authSecret),
     acctPort(config.ipAddress, config.acctPort, config.acctSecret),
     timeout(config.timeout),
     maxLost((LONG)config.maxLost),
     blackout(config.blackout),
     priority(config.priority),
     weight(config.weight),
     sendSignature(config.sendSignature),
     sendAcctOnOff(config.sendAcctOnOff),
     state(AVAILABLE),
     lostCount(0),
     expiry(0)
{
}

//////////
// We can make this inline since it's never called from outside this file.
//////////
inline bool RemoteServer::changeState(State from, State to) throw ()
{
   return (State)InterlockedCompareExchange(
                     (LPLONG)&state,
                     to,
                     from
                     ) == from;
}

bool RemoteServer::shouldBroadcast() throw ()
{
   // We only broadcast to unavailable servers and then only if we can lock the
   // server.
   if (changeState(UNAVAILABLE, LOCKED))
   {
      ULONG64 now = GetSystemTime64();

      // Has the blackout interval expired ?
      if (now > expiry)
      {
         // Yes, so set a new expiration ...
         expiry = now + blackout * 10000i64;

         // ... and unlock the server. If this transition fails, then the
         // server must have been marked available, so we don't want to send a
         // broadcast.
         return changeState(LOCKED, UNAVAILABLE);
      }

      // No, so just unlock and return false.
      changeState(LOCKED, UNAVAILABLE);
   }

   return false;
}

bool RemoteServer::onReceive() throw ()
{
   // Reset the lost count.
   lostCount = 0;

   // Force a state change to AVAILABLE.
   State previous = (State)InterlockedExchange((LPLONG)&state, AVAILABLE);

   // Did we transition?
   return previous == UNAVAILABLE;
}

bool RemoteServer::onTimeout() throw ()
{
   bool retval = false;

   // Have we exceeded the maxLost?
   if (InterlockedIncrement(&lostCount) >= maxLost)
   {
      // Yes, so lock the server ...
      if (changeState(AVAILABLE, LOCKED))
      {
         // ... and set the blackout interval.
         expiry = GetSystemTime64() + blackout * 10000i64;

         if (changeState(LOCKED, UNAVAILABLE))
         {
            // The server transitioned from AVAILABLE to UNAVAILABLE.
            retval = true;
         }
      }
   }

   return retval;
}

void RemoteServer::copyState(const RemoteServer& target) throw ()
{
   // Synchronize the ports.
   authPort.copyState(target.authPort);
   acctPort.copyState(target.acctPort);

   // Synchronize server availability.
   state = target.state;
   lostCount = target.lostCount;
   expiry = target.expiry;
}

bool RemoteServer::operator==(const RemoteServer& s) const throw ()
{
   return authPort == s.authPort &&
          acctPort == s.acctPort &&
          priority == s.priority &&
          weight == s.weight &&
          timeout == s.timeout &&
          maxLost == s.maxLost &&
          blackout == s.blackout &&
          sendSignature == s.sendSignature &&
          sendAcctOnOff == s.sendAcctOnOff;
}

//////////
// Used for sorting servers by priority.
//////////
int __cdecl sortServersByPriority(
                const RemoteServer* const* server1,
                const RemoteServer* const* server2
                ) throw ()
{
   return (int)(*server1)->priority - (int)(*server2)->priority;
}

ULONG ServerGroup::theSeed;

ServerGroup::ServerGroup(
                 PCWSTR groupName,
                 RemoteServer* const* first,
                 RemoteServer* const* last
                 )
   : servers(first, last),
     name(groupName)
{
   // We don't allow empty groups.
   if (servers.empty()) { _com_issue_error(E_INVALIDARG); }

   if (theSeed == 0)
   {
      FILETIME ft;
      GetSystemTimeAsFileTime(&ft);
      theSeed = ft.dwLowDateTime | ft.dwHighDateTime;
   }

   // Sort by priority.
   servers.sort(sortServersByPriority);

   // Find the end of the top priority servers. This will be useful when doing
   // a forced pick.
   ULONG topPriority = (*servers.begin())->priority;
   for (endTopPriority = servers.begin();
        endTopPriority != servers.end();
        ++endTopPriority)
   {
      if ((*endTopPriority)->priority != topPriority) { break; }
   }

   // Find the max number of servers at any priority level. This will be useful
   // when allocating a buffer to hold the candidates.
   ULONG maxCount = 0, count = 0, priority = (*servers.begin())->priority;
   for (RemoteServer* const* i = begin(); i != end(); ++i)
   {
      if ((*i)->priority != priority)
      {
         priority = (*i)->priority;
         count = 0;
      }
      if (++count > maxCount) { maxCount = count; }
   }

   maxCandidatesSize = maxCount * sizeof(RemoteServer*);
}

RemoteServer* ServerGroup::pickServer(
                               RemoteServer* const* first,
                               RemoteServer* const* last
                               ) throw ()
{
   // If the list has exactly one entry, there's nothing to do.
   if (last == first + 1) { return *first; }

   RemoteServer* const* i;

   // Compute the combined weight off all the servers.
   ULONG weight = 0;
   for (i  = first; i != last; ++i) { weight += (*i)->weight; }

   // Pick a random number from [0, weight)
   ULONG offset = (ULONG)
      (((ULONG64)RtlRandom(&theSeed) * (ULONG64)weight) >> 31);

   // We don't test the last server since if we make it that far we have to use
   // it anyway.
   --last;

   // Iterate through the candidates until we reach the offset.
   for (i = first; i != last; ++i)
   {
      if ((*i)->weight >= offset) { break; }

      offset -= (*i)->weight;
   }

   return *i;
}

void ServerGroup::getServersForRequest(
                      ProxyContext* context,
                      BYTE packetCode,
                      RequestStack& result
                      ) const
{
   // List of candidates.
   RemoteServer** first = (RemoteServer**)_alloca(maxCandidatesSize);
   RemoteServer** last = first;

   // Iterate through the servers.
   ULONG maxPriority = (ULONG)-1;
   for (RemoteServer* const* i = servers.begin(); i != servers.end();  ++i)
   {
      // If this test fails, we must have found a higher priority server that's
      // available.
      if ((*i)->priority > maxPriority) { break; }

      if ((*i)->isAvailable())
      {
         // Don't consider lower priority servers.
         maxPriority = (*i)->priority;

         // Add this to the list of candidates.
         *last++ = *i;
      }
      else if ((*i)->shouldBroadcast())
      {
         // It's not available, but it's ready for a broadcast
         result.push(new Request(context, *i, packetCode));
      }
   }

   if (first != last)
   {
      // We have at least one candidate, so pick one and add it to the list.
      result.push(new Request(
                          context,
                          pickServer(first, last),
                          packetCode
                          ));
   }
   else if (result.empty() && !servers.empty())
   {
      // We have no candidates and no servers available for broadcast, so just
      // force a pick from the top priority servers.
      result.push(new Request(
                          context,
                          pickServer(servers.begin(), endTopPriority),
                          packetCode
                          ));
   }
}

//////////
// Used for sorting and searching groups by name.
//////////

int __cdecl sortGroupsByName(
                const ServerGroup* const* group1,
                const ServerGroup* const* group2
                ) throw ()
{
   return wcscmp((*group1)->getName(), (*group2)->getName());
}

int __cdecl findGroupByName(
                const void* key,
                const ServerGroup* const* group
                ) throw ()
{
   return wcscmp((PCWSTR)key, (*group)->getName());
}

//////////
// Used for sorting and searching servers by address.
//////////

int __cdecl sortServersByAddress(
                const RemoteServer* const* server1,
                const RemoteServer* const* server2
                )
{
   if ((*server1)->getAddress() < (*server2)->getAddress()) { return -1; }
   if ((*server1)->getAddress() > (*server2)->getAddress()) { return  1; }
   return 0;
}

int __cdecl findServerByAddress(
                const void* key,
                const RemoteServer* const* server
                ) throw ()
{
   if ((ULONG_PTR)key < (*server)->getAddress()) { return -1; }
   if ((ULONG_PTR)key > (*server)->getAddress()) { return  1; }
   return 0;
}

//////////
// Used for sorting and searching servers by guid.
//////////

int __cdecl sortServersByGUID(
                const RemoteServer* const* server1,
                const RemoteServer* const* server2
                ) throw ()
{
   return memcmp(&(*server1)->guid, &(*server2)->guid, sizeof(GUID));
}

int __cdecl findServerByGUID(
                const void* key,
                const RemoteServer* const* server
                ) throw ()
{
   return memcmp(key, &(*server)->guid, sizeof(GUID));
}

//////////
// Used for sorting accounting servers by port.
//////////

int __cdecl sortServersByAcctPort(
                const RemoteServer* const* server1,
                const RemoteServer* const* server2
                )
{
   const sockaddr_in& a1 = (*server1)->acctPort.address;
   const sockaddr_in& a2 = (*server2)->acctPort.address;
   return memcmp(&a1.sin_port, &a2.sin_port, 6);
}

bool ServerGroupManager::setServerGroups(
                             ServerGroup* const* first,
                             ServerGroup* const* last
                             ) throw ()
{
   bool success;

   try
   {
      // Save the new server groups ...
      ServerGroups newGroups(first, last);

      // Sort by name.
      newGroups.sort(sortGroupsByName);

      // Useful iterators.
      ServerGroups::iterator i;
      RemoteServers::iterator j;

      // Count the number of servers and accounting servers.
      ULONG count = 0, acctCount = 0;
      for (i = first; i != last; ++i)
      {
         for (j = (*i)->begin(); j != (*i)->end(); ++j)
         {
            ++count;

            if ((*j)->sendAcctOnOff) { ++acctCount; }
         }
      }

      // Reserve space for the servers.
      RemoteServers newServers(count);
      RemoteServers newAcctServers(acctCount);

      // Populate the servers.
      for (i = first; i != last; ++i)
      {
         for (j = (*i)->begin(); j != (*i)->end(); ++j)
         {
            RemoteServer* newServer = *j;

            // Does this server already exist?
            RemoteServer* existing = byGuid.search(
                                         (const void*)&newServer->guid,
                                         findServerByGUID
                                         );
            if (existing)
            {
               if (*existing == *newServer)
               {
                  // If it's an exact match, use the existing server.
                  newServer = existing;
               }
               else
               {
                  // Otherwise, copy the state of the existing server.
                  newServer->copyState(*existing);
               }
            }

            newServers.push_back(newServer);

            if (newServer->sendAcctOnOff)
            {
               newAcctServers.push_back(newServer);
            }
         }
      }

      // Sort the servers by address ...
      newServers.sort(sortServersByAddress);

      // ... and GUID.
      RemoteServers newServersByGuid(newServers);
      newServersByGuid.sort(sortServersByGUID);

      // Everything is ready so now we grab the write lock ...
      monitor.LockExclusive();

      // ... and swap in the collections.
      groups.swap(newGroups);
      byAddress.swap(newServers);
      byGuid.swap(newServersByGuid);
      acctServers.swap(newAcctServers);

      monitor.Unlock();

      success = true;
   }
   catch (...)
   {
      success = false;
   }

   return success;
}

RemoteServerPtr ServerGroupManager::findServer(
                                        ULONG address
                                        ) const throw ()
{
   monitor.Lock();

   RemoteServer* server = byAddress.search(
                                         (const void*)ULongToPtr(address),
                                         findServerByAddress
                                         );

   monitor.Unlock();

   return server;
}

void ServerGroupManager::getServersByGroup(
                             ProxyContext* context,
                             BYTE packetCode,
                             PCWSTR name,
                             RequestStack& result
                             ) const throw ()
{
   monitor.Lock();

   ServerGroup* group = groups.search(name, findGroupByName);

   if (group)
   {
      group->getServersForRequest(context, packetCode, result);
   }

   monitor.Unlock();
}

void ServerGroupManager::getServersForAcctOnOff(
                             ProxyContext* context,
                             RequestStack& result
                             ) const throw ()
{
   monitor.Lock();

   for (RemoteServer* const* i = acctServers.begin();
        i != acctServers.end();
        ++i)
   {
      result.push(new Request(context, *i, RADIUS_ACCOUNTING_REQUEST));
   }

   monitor.Unlock();
}

RadiusProxyEngine* RadiusProxyEngine::theProxy;

RadiusProxyEngine::RadiusProxyEngine(RadiusProxyClient* source) throw ()
   : client(source),
     proxyAddress(INADDR_NONE),
     pending(Request::hash, 1),
     sessions(Session::hash, 1, 10000, 120000)
{
   theProxy = this;

   // We don't care if this fails. The proxy will just use INADDR_NONE in it's
   // proxy-state attribute.
   PHOSTENT he = IASGetHostByName(NULL);
   if (he)
   {
      if (he->h_addr_list[0])
      {
         proxyAddress = *(PULONG)he->h_addr_list[0];
      }

      LocalFree(he);
   }
}

RadiusProxyEngine::~RadiusProxyEngine() throw ()
{
   // Block any new reponses.
   authSock.close();
   acctSock.close();

   // Clear the pending request table.
   pending.clear();

   // Cancel all the timers.
   timers.cancelAllTimers();

   // At this point all our threads should be done, but let's just make sure.
   SwitchToThread();

   theProxy = NULL;
}

bool RadiusProxyEngine::setServerGroups(
                            ServerGroup* const* begin,
                            ServerGroup* const* end
                            ) throw ()
{
   // We don't open the sockets unless we actually have some server groups
   // configured. This is just to be a good corporate citizen.
   if (begin != end)
   {
      if ((!authSock.isOpen() && !authSock.open(this, portAuthentication)) ||
          (!acctSock.isOpen() && !acctSock.open(this, portAccounting)))
      {
         return false;
      }
   }

   return groups.setServerGroups(begin, end);
}

void RadiusProxyEngine::forwardRequest(
                            PVOID context,
                            PCWSTR serverGroup,
                            BYTE code,
                            const BYTE* requestAuthenticator,
                            const RadiusAttribute* begin,
                            const RadiusAttribute* end
                            ) throw ()
{
   // Save the request context. We have to handle this carefully since we rely
   // on the ProxyContext object to ensure that onComplete gets called exactly
   // one. If we can't allocate the object, we have to handle it specially.
   ProxyContextPtr ctxt(new (std::nothrow) ProxyContext(context));
   if (!ctxt)
   {
      client->onComplete(
                  resultNotEnoughMemory,
                  context,
                  NULL,
                  code,
                  NULL,
                  NULL
                  );
      return;
   }

   Result retval;

   // Store the in parameters in a RadiusPacket struct.
   RadiusPacket packet;
   packet.code = code;
   packet.begin = const_cast<RadiusAttribute*>(begin);
   packet.end = const_cast<RadiusAttribute*>(end);

   // Generate the list of RADIUS requests to be sent.
   RequestStack requests;
   switch (code)
   {
      case RADIUS_ACCESS_REQUEST:
      {
         // Is this request associated with a particular server?
         RemoteServerPtr server = getServerAffinity(packet);
         if (server)
         {
            requests.push(new Request(ctxt, server, RADIUS_ACCESS_REQUEST));
         }
         else
         {
            groups.getServersByGroup(
                       ctxt,
                       code,
                       serverGroup,
                       requests
                       );
            retval = resultUnknownServerGroup;
         }

         // put request authenticator in the packet.
         // the request authenticator  can be NULL
         // the authenticator will not be changed.
         packet.authenticator = requestAuthenticator;
         break;
      }

      case RADIUS_ACCOUNTING_REQUEST:
      {
         if (!IsNasStateRequest(packet))
         {
            groups.getServersByGroup(
                       ctxt,
                       code,
                       serverGroup,
                       requests
                       );
            retval = resultUnknownServerGroup;
         }
         else
         {
            groups.getServersForAcctOnOff(
                       ctxt,
                       requests
                       );

            // NAS State requests are always reported as a success since we
            // don't care if it gets to all the destinations.
            context = ctxt->takeOwnership();
            if (context)
            {
               client->onComplete(
                           resultSuccess,
                           context,
                           NULL,
                           RADIUS_ACCOUNTING_RESPONSE,
                           NULL,
                           NULL
                           );
            }
            retval = resultSuccess;
         }
         break;
      }

      default:
      {
         retval = resultInvalidRequest;
      }
   }

   if (!requests.empty())
   {
      // First we handle the primary.
      RequestPtr request = requests.pop();
      ctxt->setPrimaryServer(&request->getServer());
      retval = sendRequest(packet, request);

      // Now we broadcast.
      while (!requests.empty())
      {
         request = requests.pop();
         Result result = sendRequest(packet, request);
         if (result == resultSuccess && retval != resultSuccess)
         {
            // This was the first request to succeed so mark it as primary.
            retval = resultSuccess;
            ctxt->setPrimaryServer(&request->getServer());
         }
      }
   }

   if (retval != resultSuccess)
   {
      // If we made it here, then we didn't successfully send a packet to any
      // server, so we have to report the result ourself.
      context = ctxt->takeOwnership();
      if (context)
      {
         client->onComplete(
                     retval,
                     context,
                     ctxt->getPrimaryServer(),
                     code,
                     NULL,
                     NULL
                     );
      }
   }
}

void RadiusProxyEngine::onRequestAbandoned(
                            PVOID context,
                            RemoteServer* server
                            ) throw ()
{
   // Nobody took responsibility for the request, so we time it out.
   theProxy->client->onComplete(
                         resultRequestTimeout,
                         context,
                         server,
                         0,
                         NULL,
                         NULL
                         );
}

inline void RadiusProxyEngine::reportEvent(
                                   const RadiusEvent& event
                                   ) const throw ()
{
   client->onEvent(event);
}

inline void RadiusProxyEngine::reportEvent(
                                   RadiusEvent& event,
                                   RadiusEventType type
                                   ) const throw ()
{
   event.eventType = type;
   client->onEvent(event);
}

void RadiusProxyEngine::onRequestTimeout(
                            Request* request
                            ) throw ()
{
   // Erase the pending request. If it's not there, that's okay; it means that
   // we received a response, but weren't able to cancel the timer in time.
   if (theProxy->pending.erase(request->getRequestID()))
   {
      RadiusEvent event =
      {
         request->getPortType(),
         eventTimeout,
         &request->getServer(),
         request->getPort().address.address(),
         request->getPort().address.port()
      };

      // Report the protocol event.
      theProxy->reportEvent(event);

      // Update request state.
      if (request->onTimeout())
      {
         // The server was just marked unavailable, so notify the client.
         theProxy->reportEvent(event, eventServerUnavailable);
      }
   }
}

RemoteServerPtr RadiusProxyEngine::getServerAffinity(
                                       const RadiusPacket& packet
                                       ) throw ()
{
   // Find the State attribute.
   const RadiusAttribute* attr = FindAttribute(packet, RADIUS_STATE);
   if (!attr) { return NULL; }

   // Map it to a session.
   RadiusRawOctets key = { attr->value, attr->length };
   SessionPtr session = sessions.find(key);
   if (!session) { return NULL; }

   return &session->getServer();
}

void RadiusProxyEngine::setServerAffinity(
                            const RadiusPacket& packet,
                            RemoteServer& server
                            ) throw ()
{
   // Is this an Access-Challenge ?
   if (packet.code != RADIUS_ACCESS_CHALLENGE) { return; }

   // Find the State attribute.
   const RadiusAttribute* state = FindAttribute(packet, RADIUS_STATE);
   if (!state) { return; }

   // Do we already have an entry for this State value.
   RadiusRawOctets key = { state->value, state->length };
   SessionPtr session = sessions.find(key);
   if (session)
   {
      // Make sure the server matches.
      session->setServer(server);
      return;
   }

   // Otherwise, we'll have to create a new one.
   try
   {
      session = new Session(key, server);
      sessions.insert(*session);
   }
   catch (...)
   {
      // We don't care if this fails.
   }
}

void RadiusProxyEngine::onReceive(
                            UDPSocket& socket,
                            ULONG_PTR key,
                            const SOCKADDR_IN& remoteAddress,
                            BYTE* buffer,
                            ULONG bufferLength
                            ) throw ()
{
   //////////
   // Set up the event struct. We'll fill in the other fields as we go along.
   //////////

   RadiusEvent event =
   {
      (RadiusPortType)key,
      eventNone,
      NULL,
      remoteAddress.sin_addr.s_addr,
      remoteAddress.sin_port,
      buffer,
      bufferLength,
      0
   };

   //////////
   // Validate the remote address.
   //////////

   RemoteServerPtr server = groups.findServer(
                                       remoteAddress.sin_addr.s_addr
                                       );
   if (!server)
   {
      reportEvent(event, eventInvalidAddress);
      return;
   }

   // Use the server as the event context.
   event.context = server;

   //////////
   // Validate the packet type.
   //////////

   if (bufferLength == 0)
   {
      reportEvent(event, eventUnknownType);
      return;
   }

   switch (MAKELONG(key, buffer[0]))
   {
      case MAKELONG(portAuthentication, RADIUS_ACCESS_ACCEPT):
         reportEvent(event, eventAccessAccept);
         break;

      case MAKELONG(portAuthentication, RADIUS_ACCESS_REJECT):
         reportEvent(event, eventAccessReject);
         break;

      case MAKELONG(portAuthentication, RADIUS_ACCESS_CHALLENGE):
         reportEvent(event, eventAccessChallenge);
         break;

      case MAKELONG(portAccounting, RADIUS_ACCOUNTING_RESPONSE):
         reportEvent(event, eventAccountingResponse);
         break;

      default:
         reportEvent(event, eventUnknownType);
         return;
   }

   //////////
   // Validate that the packet is properly formatted.
   //////////

   RadiusPacket* packet;
   ALLOC_PACKET_FOR_BUFFER(packet, buffer, bufferLength);
   if (!packet)
   {
      reportEvent(event, eventMalformedPacket);
      return;
   }

   // Unpack the attributes.
   UnpackBuffer(buffer, bufferLength, *packet);

   //////////
   // Validate that we were expecting this response.
   //////////

   // Look for our Proxy-State attribute.
   RadiusAttribute* proxyState = FindAttribute(
                                     *packet,
                                     RADIUS_PROXY_STATE
                                     );

   // If we didn't find it OR it's the wrong length OR it doesn't start with
   // our address, then we weren't expecting this packet.
   if (!proxyState ||
       proxyState->length != 8 ||
       memcmp(proxyState->value, &proxyAddress, 4))
   {
      reportEvent(event, eventUnexpectedResponse);
      return;
   }

   // Extract the request ID.
   ULONG requestID = ExtractUInt32(proxyState->value + 4);

   // Don't send the Proxy-State back to our client.
   --packet->end;
   memmove(
       proxyState,
       proxyState + 1,
       (packet->end - proxyState) * sizeof(RadiusAttribute)
       );

   // Look up the request object. We don't remove it yet because we don't know
   // if this is an authentic response.
   RequestPtr request = pending.find(requestID);
   if (!request)
   {
      // If it's not there, we'll assume that this is a packet that's
      // already been reported as a timeout.
      reportEvent(event, eventLateResponse);
      return;
   }

   // Get the actual server we used for the request in case there are multiple
   // servers defined for the same IP address.
   event.context = server = &request->getServer();

   const RemotePort& port = request->getPort();

   // Validate the packet source && identifier.
   if (!(port.address == remoteAddress) ||
       request->getIdentifier() != packet->identifier)
   {
      reportEvent(event, eventUnexpectedResponse);
      return;
   }

   //////////
   // Validate that the packet is authentic.
   //////////

   AuthResult authResult = AuthenticateAndDecrypt(
                               request->getAuthenticator(),
                               port.secret,
                               port.secret.length(),
                               buffer,
                               bufferLength,
                               *packet
                               );
   switch (authResult)
   {
      case AUTH_BAD_AUTHENTICATOR:
         reportEvent(event, eventBadAuthenticator);
         return;

      case AUTH_BAD_SIGNATURE:
         reportEvent(event, eventBadSignature);
         return;

      case AUTH_MISSING_SIGNATURE:
         reportEvent(event, eventMissingSignature);
         return;
   }

   //////////
   // At this point, all the tests have passed -- we have the real thing.
   //////////

   if (!pending.erase(requestID))
   {
      // It must have timed out while we were authenticating it.
      reportEvent(event, eventLateResponse);
      return;
   }

   // Update endpoint state.
   if (request->onReceive())
   {
      // The server just came up, so notify the client.
      reportEvent(event, eventServerAvailable);
   }

   // Update the round-trip time.
   event.data = request->getRoundTripTime();
   reportEvent(event, eventRoundTrip);

   // Set the server affinity.
   setServerAffinity(*packet, *server);

   // Take ownership of the context.
   PVOID context = request->getContext().takeOwnership();
   if (context)
   {
      // The magic moment -- we have successfully processed the response.
      client->onComplete(
                  resultSuccess,
                  context,
                  &request->getServer(),
                  packet->code,
                  packet->begin,
                  packet->end
                  );
   }
}

void RadiusProxyEngine::onReceiveError(
                            UDPSocket& socket,
                            ULONG_PTR key,
                            ULONG errorCode
                            ) throw ()
{
   RadiusEvent event =
   {
      (RadiusPortType)key,
      eventReceiveError,
      NULL,
      socket.getLocalAddress().address(),
      socket.getLocalAddress().port(),
      NULL,
      0,
      errorCode
   };

   client->onEvent(event);
}


RadiusProxyEngine::Result RadiusProxyEngine::sendRequest(
                                                 RadiusPacket& packet,
                                                 Request* request
                                                 )
{
   // Fill in the packet identifier.
   packet.identifier = request->getIdentifier();

   // Get the info for the Signature.
   BOOL sign = request->getServer().sendSignature;

   // Format the Proxy-State attributes.
   BYTE proxyStateValue[8];
   RadiusAttribute proxyState = { RADIUS_PROXY_STATE, 8, proxyStateValue };

   // First our IP address ...
   memcpy(proxyStateValue, &proxyAddress, 4);
   // ... and then the unique request ID.
   InsertUInt32(proxyStateValue + 4, request->getRequestID());

   // Allocate a buffer to hold the packet on the wire.
   PBYTE buffer;
   ALLOC_BUFFER_FOR_PACKET(buffer, &packet, &proxyState, sign);
   if (!buffer) { return resultInvalidRequest; }

   // Get the port for this request.
   const RemotePort& port = request->getPort();


   // Pack the buffer.
   // packet.authenticator is used for CHAP when the request authenticator
   // is used for the chap-challenge. It can be null
   PackBuffer(
       port.secret,
       port.secret.length(),
       packet,
       &proxyState,
       sign,
       buffer
       );

   // Save the request authenticator.
   request->setAuthenticator(buffer + 4);

   // Determine the request type.
   bool isAuth = request->isAccReq();

   // Set up the event struct.
   RadiusEvent event =
   {
      (isAuth ? portAuthentication : portAccounting),
      (isAuth ? eventAccessRequest : eventAccountingRequest),
      &request->getServer(),
      port.address.address(),
      port.address.port(),
      buffer,
      packet.length
   };

   // Get the appropriate socket.
   UDPSocket& sock = isAuth ? authSock : acctSock;

   // Insert the pending request before we send it to avoid a race condition.
   pending.insert(*request);

   // The magic moment -- we actually send the request.
   Result result;
   if (sock.send(port.address, buffer, packet.length))
   {
      // Update request state.
      request->onSend();

      // Set a timer to clean up if the server doesn't answer.
      if (timers.setTimer(request, request->getServer().timeout, 0))
      {
         result = resultSuccess;
      }
      else
      {
         // If we can't set at timer we have to remove it from the pending
         // requests table or else it could leak.
         pending.erase(*request);
         result = resultNotEnoughMemory;
      }
   }
   else
   {
      // Update the event with the error data.
      event.eventType = eventSendError;
      event.data = GetLastError();

      // If we received "Port Unreachable" ICMP packet, we'll count this as a
      // timeout since it means the server is unavailable.
      if (event.data == WSAECONNRESET) { request->onTimeout(); }

      // Remove from the pending requests table.
      pending.erase(*request);
   }

   // Report the event ...
   reportEvent(event);

   // ... and the result.
   return result;
}