src/modules/rlm_eap/mem.c

   1 /*
   2  * mem.c  Memory allocation, deallocation stuff.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2001,2006  The FreeRADIUS server project
  21  * Copyright 2001  hereUare Communications, Inc. <raghud@hereuare.com>
  22  */
  23
  24 RCSID("$Id$")
  25
  26 #include <stdio.h>
  27 #include "rlm_eap.h"
  28
  29 #ifdef HAVE_PTHREAD_H
  30 #define PTHREAD_MUTEX_LOCK pthread_mutex_lock
  31 #define PTHREAD_MUTEX_UNLOCK pthread_mutex_unlock
  32 #else
  33 #define PTHREAD_MUTEX_LOCK(_x)
  34 #define PTHREAD_MUTEX_UNLOCK(_x)
  35 #endif
  36
  37 /*
  38  * Allocate a new eap_packet_t
  39  */
  40 EAP_DS *eap_ds_alloc(eap_handler_t *handler)
  41 {
  42         EAP_DS  *eap_ds;
  43
  44         eap_ds = talloc_zero(handler, EAP_DS);
  45         eap_ds->response = talloc_zero(eap_ds, eap_packet_t);
  46         if (!eap_ds->response) {
  47                 eap_ds_free(&eap_ds);
  48                 return NULL;
  49         }
  50         eap_ds->request = talloc_zero(eap_ds, eap_packet_t);
  51         if (!eap_ds->response) {
  52                 eap_ds_free(&eap_ds);
  53                 return NULL;
  54         }
  55
  56         return eap_ds;
  57 }
  58
  59 void eap_ds_free(EAP_DS **eap_ds_p)
  60 {
  61         EAP_DS *eap_ds;
  62
  63         if (!eap_ds_p) return;
  64
  65         eap_ds = *eap_ds_p;
  66         if (!eap_ds) return;
  67
  68         if (eap_ds->response) talloc_free(eap_ds->response);
  69         if (eap_ds->request) talloc_free(eap_ds->request);
  70
  71         talloc_free(eap_ds);
  72         *eap_ds_p = NULL;
  73 }
  74
  75 static int _eap_handler_free(eap_handler_t *handler)
  76 {
  77         rlm_eap_t *inst = handler->inst_holder;
  78
  79         if (handler->identity) {
  80                 talloc_free(handler->identity);
  81                 handler->identity = NULL;
  82         }
  83
  84         if (handler->prev_eapds) eap_ds_free(&(handler->prev_eapds));
  85         if (handler->eap_ds) eap_ds_free(&(handler->eap_ds));
  86
  87         if ((handler->opaque) && (handler->free_opaque)) {
  88                 handler->free_opaque(handler->opaque);
  89                 handler->opaque = NULL;
  90         }
  91
  92         handler->opaque = NULL;
  93         handler->free_opaque = NULL;
  94
  95         if (handler->certs) pairfree(&handler->certs);
  96
  97         PTHREAD_MUTEX_LOCK(&(inst->handler_mutex));
  98         if (inst->handler_tree) {
  99                 rbtree_deletebydata(inst->handler_tree, handler);
 100         }
 101         /*
 102          *      Free operations need to be synchronised too.
 103          */
 104         talloc_free(handler);
 105         PTHREAD_MUTEX_UNLOCK(&(inst->handler_mutex));
 106
 107         return 0;
 108 }
 109
 110 /*
 111  * Allocate a new eap_handler_t
 112  */
 113 eap_handler_t *eap_handler_alloc(rlm_eap_t *inst)
 114 {
 115         eap_handler_t   *handler;
 116
 117         PTHREAD_MUTEX_LOCK(&(inst->handler_mutex));
 118         handler = talloc_zero(inst, eap_handler_t);
 119
 120         if (inst->handler_tree) {
 121                 rbtree_insert(inst->handler_tree, handler);
 122         }
 123         handler->inst_holder = inst;
 124
 125         PTHREAD_MUTEX_UNLOCK(&(inst->handler_mutex));
 126         talloc_set_destructor(handler, _eap_handler_free);
 127
 128         return handler;
 129 }
 130
 131 typedef struct check_handler_t {
 132         rlm_eap_t       *inst;
 133         eap_handler_t   *handler;
 134         int             trips;
 135 } check_handler_t;
 136
 137 static int check_opaque_free(check_handler_t *check)
 138 {
 139         bool do_warning = false;
 140         uint8_t state[8];
 141
 142         if (!check->inst || !check->handler) {
 143                 return 0;
 144         }
 145
 146         if (!check->inst->handler_tree) goto done;
 147
 148         PTHREAD_MUTEX_LOCK(&(check->inst->handler_mutex));
 149         if (!rbtree_finddata(check->inst->handler_tree, check->handler)) {
 150                 goto done;
 151         }
 152
 153         /*
 154          *      The session has continued *after* this packet.
 155          *      Don't do a warning.
 156          */
 157         if (check->handler->trips > check->trips) {
 158                 goto done;
 159         }
 160
 161         /*
 162          *      No TLS means no warnings.
 163          */
 164         if (!check->handler->tls) goto done;
 165
 166         /*
 167          *      If we're being deleted early, it's likely because we
 168          *      received a transmit from the client that re-uses the
 169          *      same RADIUS Id, which forces the current packet to be
 170          *      deleted.  In that case, ignore the error.
 171          */
 172         if (time(NULL) < (check->handler->timestamp + 3)) goto done;
 173
 174         if (!check->handler->finished) {
 175                 do_warning = true;
 176                 memcpy(state, check->handler->state, sizeof(state));
 177         }
 178
 179 done:
 180         PTHREAD_MUTEX_UNLOCK(&(check->inst->handler_mutex));
 181
 182         if (do_warning) {
 183                 WARN("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 184                 WARN("!! EAP session with state 0x%02x%02x%02x%02x%02x%02x%02x%02x did not finish!  !!",
 185                       state[0], state[1],
 186                       state[2], state[3],
 187                       state[4], state[5],
 188                       state[6], state[7]);
 189
 190                 WARN("!! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility     !!");
 191                 WARN("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 192         }
 193
 194         return 0;
 195 }
 196
 197 void eaplist_free(rlm_eap_t *inst)
 198 {
 199         eap_handler_t *node, *next;
 200
 201         for (node = inst->session_head; node != NULL; node = next) {
 202                 next = node->next;
 203                 talloc_free(node);
 204         }
 205
 206         inst->session_head = inst->session_tail = NULL;
 207 }
 208
 209 /*
 210  *      Return a 32-bit random number.
 211  */
 212 static uint32_t eap_rand(fr_randctx *ctx)
 213 {
 214         uint32_t num;
 215
 216         num = ctx->randrsl[ctx->randcnt++];
 217         if (ctx->randcnt >= 256) {
 218                 ctx->randcnt = 0;
 219                 fr_isaac(ctx);
 220         }
 221
 222         return num;
 223 }
 224
 225
 226 static eap_handler_t *eaplist_delete(rlm_eap_t *inst, REQUEST *request,
 227                                    eap_handler_t *handler)
 228 {
 229         rbnode_t *node;
 230
 231         node = rbtree_find(inst->session_tree, handler);
 232         if (!node) return NULL;
 233
 234         handler = rbtree_node2data(inst->session_tree, node);
 235
 236         RDEBUG("Finished EAP session with state "
 237                "0x%02x%02x%02x%02x%02x%02x%02x%02x",
 238                handler->state[0], handler->state[1],
 239                handler->state[2], handler->state[3],
 240                handler->state[4], handler->state[5],
 241                handler->state[6], handler->state[7]);
 242         /*
 243          *      Delete old handler from the tree.
 244          */
 245         rbtree_delete(inst->session_tree, node);
 246
 247         /*
 248          *      And unsplice it from the linked list.
 249          */
 250         if (handler->prev) {
 251                 handler->prev->next = handler->next;
 252         } else {
 253                 inst->session_head = handler->next;
 254         }
 255         if (handler->next) {
 256                 handler->next->prev = handler->prev;
 257         } else {
 258                 inst->session_tail = handler->prev;
 259         }
 260         handler->prev = handler->next = NULL;
 261
 262         return handler;
 263 }
 264
 265
 266 static void eaplist_expire(rlm_eap_t *inst, REQUEST *request, time_t timestamp)
 267 {
 268         int i;
 269         eap_handler_t *handler;
 270
 271         /*
 272          *      Check the first few handlers in the list, and delete
 273          *      them if they're too old.  We don't need to check them
 274          *      all, as incoming requests will quickly cause older
 275          *      handlers to be deleted.
 276          *
 277          */
 278         for (i = 0; i < 3; i++) {
 279                 handler = inst->session_head;
 280                 if (!handler) break;
 281
 282                 RDEBUG("Expiring EAP session with state "
 283                        "0x%02x%02x%02x%02x%02x%02x%02x%02x",
 284                        handler->state[0], handler->state[1],
 285                        handler->state[2], handler->state[3],
 286                        handler->state[4], handler->state[5],
 287                        handler->state[6], handler->state[7]);
 288
 289                 /*
 290                  *      Expire entries from the start of the list.
 291                  *      They should be the oldest ones.
 292                  */
 293                 if ((timestamp - handler->timestamp) > (int)inst->timer_limit) {
 294                         rbnode_t *node;
 295                         node = rbtree_find(inst->session_tree, handler);
 296                         rad_assert(node != NULL);
 297                         rbtree_delete(inst->session_tree, node);
 298
 299                         /*
 300                          *      handler == inst->session_head
 301                          */
 302                         inst->session_head = handler->next;
 303                         if (handler->next) {
 304                                 handler->next->prev = NULL;
 305                         } else {
 306                                 inst->session_head = NULL;
 307                                 inst->session_tail = NULL;
 308                         }
 309                         talloc_free(handler);
 310                 } else {
 311                         break;
 312                 }
 313         }
 314 }
 315
 316 /*
 317  *      Add a handler to the set of active sessions.
 318  *
 319  *      Since we're adding it to the list, we guess that this means
 320  *      the packet needs a State attribute.  So add one.
 321  */
 322 int eaplist_add(rlm_eap_t *inst, eap_handler_t *handler)
 323 {
 324         int             status = 0;
 325         VALUE_PAIR      *state;
 326         REQUEST         *request = handler->request;
 327
 328         /*
 329          *      Generate State, since we've been asked to add it to
 330          *      the list.
 331          */
 332         state = pairmake_reply("State", NULL, T_OP_EQ);
 333         if (!state) return 0;
 334
 335         /*
 336          *      The time at which this request was made was the time
 337          *      at which it was received by the RADIUS server.
 338          */
 339         handler->timestamp = request->timestamp;
 340         handler->status = 1;
 341
 342         handler->src_ipaddr = request->packet->src_ipaddr;
 343         handler->eap_id = handler->eap_ds->request->id;
 344
 345         /*
 346          *      Playing with a data structure shared among threads
 347          *      means that we need a lock, to avoid conflict.
 348          */
 349         PTHREAD_MUTEX_LOCK(&(inst->session_mutex));
 350
 351         /*
 352          *      If we have a DoS attack, discard new sessions.
 353          */
 354         if (rbtree_num_elements(inst->session_tree) >= inst->max_sessions) {
 355                 status = -1;
 356                 eaplist_expire(inst, request, handler->timestamp);
 357                 goto done;
 358         }
 359
 360         /*
 361          *      Create a unique content for the State variable.
 362          *      It will be modified slightly per round trip, but less so
 363          *      than in 1.x.
 364          */
 365         if (handler->trips == 0) {
 366                 int i;
 367
 368                 for (i = 0; i < 4; i++) {
 369                         uint32_t lvalue;
 370
 371                         lvalue = eap_rand(&inst->rand_pool);
 372
 373                         memcpy(handler->state + i * 4, &lvalue,
 374                                sizeof(lvalue));
 375                 }
 376         }
 377
 378         /*
 379          *      Add some more data to distinguish the sessions.
 380          */
 381         handler->state[4] = handler->trips ^ handler->state[0];
 382         handler->state[5] = handler->eap_id ^ handler->state[1];
 383         handler->state[6] = handler->type ^ handler->state[2];
 384
 385         pairmemcpy(state, handler->state, sizeof(handler->state));
 386
 387         /*
 388          *      Big-time failure.
 389          */
 390         status = rbtree_insert(inst->session_tree, handler);
 391
 392         /*
 393          *      Catch Access-Challenge without response.
 394          */
 395         if (inst->handler_tree) {
 396                 check_handler_t *check = talloc(handler, check_handler_t);
 397
 398                 check->inst = inst;
 399                 check->handler = handler;
 400                 check->trips = handler->trips;
 401
 402                 talloc_set_destructor(check, check_opaque_free);
 403                 request_data_add(request, inst, 0, check, true);
 404         }
 405
 406         if (status) {
 407                 eap_handler_t *prev;
 408
 409                 prev = inst->session_tail;
 410                 if (prev) {
 411                         prev->next = handler;
 412                         handler->prev = prev;
 413                         handler->next = NULL;
 414                         inst->session_tail = handler;
 415                 } else {
 416                         inst->session_head = inst->session_tail = handler;
 417                         handler->next = handler->prev = NULL;
 418                 }
 419         }
 420
 421         /*
 422          *      Now that we've finished mucking with the list,
 423          *      unlock it.
 424          */
 425  done:
 426
 427         /*
 428          *      We don't need this any more.
 429          */
 430         if (status > 0) handler->request = NULL;
 431
 432         PTHREAD_MUTEX_UNLOCK(&(inst->session_mutex));
 433
 434         if (status <= 0) {
 435                 pairfree(&state);
 436
 437                 if (status < 0) {
 438                         static time_t last_logged = 0;
 439
 440                         if (last_logged < handler->timestamp) {
 441                                 last_logged = handler->timestamp;
 442                                 ERROR("rlm_eap (%s): Too many open sessions. Try increasing \"max_sessions\" "
 443                                       "in the EAP module configuration", inst->xlat_name);
 444                         }
 445                 } else {
 446                         ERROR("rlm_eap (%s): Failed to store handler", inst->xlat_name);
 447                 }
 448                 return 0;
 449         }
 450
 451         RDEBUG("New EAP session, adding 'State' attribute to reply 0x%02x%02x%02x%02x%02x%02x%02x%02x",
 452                state->vp_octets[0], state->vp_octets[1], state->vp_octets[2], state->vp_octets[3],
 453                state->vp_octets[4], state->vp_octets[5], state->vp_octets[6], state->vp_octets[7]);
 454
 455         return 1;
 456 }
 457
 458 /*
 459  *      Find a a previous EAP-Request sent by us, which matches
 460  *      the current EAP-Response.
 461  *
 462  *      Then, release the handle from the list, and return it to
 463  *      the caller.
 464  *
 465  *      Also since we fill the eap_ds with the present EAP-Response we
 466  *      got to free the prev_eapds & move the eap_ds to prev_eapds
 467  */
 468 eap_handler_t *eaplist_find(rlm_eap_t *inst, REQUEST *request,
 469                           eap_packet_raw_t *eap_packet)
 470 {
 471         VALUE_PAIR      *state;
 472         eap_handler_t   *handler, myHandler;
 473
 474         /*
 475          *      We key the sessions off of the 'state' attribute, so it
 476          *      must exist.
 477          */
 478         state = pairfind(request->packet->vps, PW_STATE, 0, TAG_ANY);
 479         if (!state ||
 480             (state->length != EAP_STATE_LEN)) {
 481                 return NULL;
 482         }
 483
 484         myHandler.src_ipaddr = request->packet->src_ipaddr;
 485         myHandler.eap_id = eap_packet->id;
 486         memcpy(myHandler.state, state->vp_strvalue, sizeof(myHandler.state));
 487
 488         /*
 489          *      Playing with a data structure shared among threads
 490          *      means that we need a lock, to avoid conflict.
 491          */
 492         PTHREAD_MUTEX_LOCK(&(inst->session_mutex));
 493
 494         eaplist_expire(inst, request, request->timestamp);
 495
 496         handler = eaplist_delete(inst, request, &myHandler);
 497         PTHREAD_MUTEX_UNLOCK(&(inst->session_mutex));
 498
 499         /*
 500          *      Might not have been there.
 501          */
 502         if (!handler) {
 503                 ERROR("rlm_eap (%s): No EAP session matching state "
 504                        "0x%02x%02x%02x%02x%02x%02x%02x%02x",
 505                        inst->xlat_name,
 506                        state->vp_octets[0], state->vp_octets[1],
 507                        state->vp_octets[2], state->vp_octets[3],
 508                        state->vp_octets[4], state->vp_octets[5],
 509                        state->vp_octets[6], state->vp_octets[7]);
 510                 return NULL;
 511         }
 512
 513         if (handler->trips >= 50) {
 514                 ERROR("rlm_eap (%s): Aborting! More than 50 roundtrips "
 515                        "made in session with state "
 516                        "0x%02x%02x%02x%02x%02x%02x%02x%02x",
 517                        inst->xlat_name,
 518                        state->vp_octets[0], state->vp_octets[1],
 519                        state->vp_octets[2], state->vp_octets[3],
 520                        state->vp_octets[4], state->vp_octets[5],
 521                        state->vp_octets[6], state->vp_octets[7]);
 522
 523
 524                 talloc_free(handler);
 525                 return NULL;
 526         }
 527         handler->trips++;
 528
 529         RDEBUG("Previous EAP request found for state "
 530                "0x%02x%02x%02x%02x%02x%02x%02x%02x, released from the list",
 531                 state->vp_octets[0], state->vp_octets[1],
 532                 state->vp_octets[2], state->vp_octets[3],
 533                 state->vp_octets[4], state->vp_octets[5],
 534                 state->vp_octets[6], state->vp_octets[7]);
 535
 536         /*
 537          *      Remember what the previous request was.
 538          */
 539         eap_ds_free(&(handler->prev_eapds));
 540         handler->prev_eapds = handler->eap_ds;
 541         handler->eap_ds = NULL;
 542
 543         return handler;
 544 }