src/modules/rlm_eap/mem.c

   1 /*
   2  * mem.c  Memory allocation, deallocation stuff.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2001,2006  The FreeRADIUS server project
  21  * Copyright 2001  hereUare Communications, Inc. <raghud@hereuare.com>
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include <stdio.h>
  28 #include "rlm_eap.h"
  29
  30 #ifdef HAVE_PTHREAD_H
  31 #define PTHREAD_MUTEX_LOCK pthread_mutex_lock
  32 #define PTHREAD_MUTEX_UNLOCK pthread_mutex_unlock
  33 #else
  34 #define PTHREAD_MUTEX_LOCK(_x)
  35 #define PTHREAD_MUTEX_UNLOCK(_x)
  36 #endif
  37
  38 /*
  39  * Allocate a new EAP_PACKET
  40  */
  41 EAP_PACKET *eap_packet_alloc(void)
  42 {
  43         EAP_PACKET   *rp;
  44
  45         rp = rad_malloc(sizeof(EAP_PACKET));
  46         memset(rp, 0, sizeof(EAP_PACKET));
  47         return rp;
  48 }
  49
  50 /*
  51  * Free EAP_PACKET
  52  */
  53 void eap_packet_free(EAP_PACKET **eap_packet_ptr)
  54 {
  55         EAP_PACKET *eap_packet;
  56
  57         if (!eap_packet_ptr) return;
  58         eap_packet = *eap_packet_ptr;
  59         if (!eap_packet) return;
  60
  61         if (eap_packet->type.data) {
  62                 /*
  63                  *      There's no packet, OR the type data isn't
  64                  *      pointing inside of the packet: free it.
  65                  */
  66                 if ((eap_packet->packet == NULL) ||
  67                     (eap_packet->type.data != (eap_packet->packet + 5))) {
  68                         free(eap_packet->type.data);
  69                 }
  70                 eap_packet->type.data = NULL;
  71         }
  72
  73         if (eap_packet->packet) {
  74                 free(eap_packet->packet);
  75                 eap_packet->packet = NULL;
  76         }
  77
  78         free(eap_packet);
  79
  80         *eap_packet_ptr = NULL;
  81 }
  82
  83 /*
  84  * Allocate a new EAP_PACKET
  85  */
  86 EAP_DS *eap_ds_alloc(void)
  87 {
  88         EAP_DS  *eap_ds;
  89
  90         eap_ds = rad_malloc(sizeof(EAP_DS));
  91         memset(eap_ds, 0, sizeof(EAP_DS));
  92         if ((eap_ds->response = eap_packet_alloc()) == NULL) {
  93                 eap_ds_free(&eap_ds);
  94                 return NULL;
  95         }
  96         if ((eap_ds->request = eap_packet_alloc()) == NULL) {
  97                 eap_ds_free(&eap_ds);
  98                 return NULL;
  99         }
 100
 101         return eap_ds;
 102 }
 103
 104 void eap_ds_free(EAP_DS **eap_ds_p)
 105 {
 106         EAP_DS *eap_ds;
 107
 108         if (!eap_ds_p) return;
 109
 110         eap_ds = *eap_ds_p;
 111         if (!eap_ds) return;
 112
 113         if (eap_ds->response) eap_packet_free(&(eap_ds->response));
 114         if (eap_ds->request) eap_packet_free(&(eap_ds->request));
 115
 116         free(eap_ds);
 117         *eap_ds_p = NULL;
 118 }
 119
 120 /*
 121  * Allocate a new EAP_HANDLER
 122  */
 123 EAP_HANDLER *eap_handler_alloc(rlm_eap_t *inst)
 124 {
 125         EAP_HANDLER     *handler;
 126
 127         handler = rad_malloc(sizeof(EAP_HANDLER));
 128         memset(handler, 0, sizeof(EAP_HANDLER));
 129
 130         if (inst->handler_tree) {
 131                 PTHREAD_MUTEX_LOCK(&(inst->handler_mutex));
 132                 rbtree_insert(inst->handler_tree, handler);
 133                 PTHREAD_MUTEX_UNLOCK(&(inst->handler_mutex));
 134
 135         }
 136         return handler;
 137 }
 138
 139 void eap_opaque_free(EAP_HANDLER *handler)
 140 {
 141         if (!handler)
 142                 return;
 143
 144         eap_handler_free(handler->inst_holder, handler);
 145 }
 146
 147 void eap_handler_free(rlm_eap_t *inst, EAP_HANDLER *handler)
 148 {
 149         if (!handler)
 150                 return;
 151
 152         if (inst->handler_tree) {
 153                 PTHREAD_MUTEX_LOCK(&(inst->handler_mutex));
 154                 rbtree_deletebydata(inst->handler_tree, handler);
 155                 PTHREAD_MUTEX_UNLOCK(&(inst->handler_mutex));
 156         }
 157
 158         if (handler->identity) {
 159                 free(handler->identity);
 160                 handler->identity = NULL;
 161         }
 162
 163         if (handler->prev_eapds) eap_ds_free(&(handler->prev_eapds));
 164         if (handler->eap_ds) eap_ds_free(&(handler->eap_ds));
 165
 166         if ((handler->opaque) && (handler->free_opaque)) {
 167                 handler->free_opaque(handler->opaque);
 168                 handler->opaque = NULL;
 169         }
 170         else if ((handler->opaque) && (handler->free_opaque == NULL))
 171                 radlog(L_ERR, "rlm_eap (%s): Possible memory leak ...",
 172                        inst->xlat_name);
 173
 174         handler->opaque = NULL;
 175         handler->free_opaque = NULL;
 176
 177         if (handler->certs) pairfree(&handler->certs);
 178
 179         free(handler);
 180 }
 181
 182
 183 typedef struct check_handler_t {
 184         rlm_eap_t       *inst;
 185         EAP_HANDLER     *handler;
 186         int             trips;
 187 } check_handler_t;
 188
 189 static void check_handler(void *data)
 190 {
 191         int do_warning = FALSE;
 192         uint8_t state[8];
 193         check_handler_t *check = data;
 194
 195         if (!check) return;
 196
 197         if (!check->inst || !check->handler) {
 198                 free(check);
 199                 return;
 200         }
 201
 202         if (!check->inst->handler_tree) goto done;
 203
 204         PTHREAD_MUTEX_LOCK(&(check->inst->handler_mutex));
 205         if (!rbtree_finddata(check->inst->handler_tree, check->handler)) {
 206                 goto done;
 207         }
 208
 209         /*
 210          *      The session has continued *after* this packet.
 211          *      Don't do a warning.
 212          */
 213         if (check->handler->trips > check->trips) {
 214                 goto done;
 215         }
 216
 217         /*
 218          *      No TLS means no warnings.
 219          */
 220         if (!check->handler->tls) goto done;
 221
 222         /*
 223          *      If we're being deleted early, it's likely because we
 224          *      received a transmit from the client that re-uses the
 225          *      same RADIUS Id, which forces the current packet to be
 226          *      deleted.  In that case, ignore the error.
 227          */
 228         if (time(NULL) < (check->handler->timestamp + 3)) goto done;
 229
 230         if (!check->handler->finished) {
 231                 do_warning = TRUE;
 232                 memcpy(state, check->handler->state, sizeof(state));
 233         }
 234
 235 done:
 236         PTHREAD_MUTEX_UNLOCK(&(check->inst->handler_mutex));
 237         free(check);
 238
 239         if (do_warning) {
 240                 DEBUGW("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 241                 DEBUGW("!! EAP session with state 0x%02x%02x%02x%02x%02x%02x%02x%02x did not finish!  !!",
 242                       state[0], state[1],
 243                       state[2], state[3],
 244                       state[4], state[5],
 245                       state[6], state[7]);
 246
 247                 DEBUGW("!! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility     !!");
 248                 DEBUGW("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 249         }
 250 }
 251
 252 void eaptype_free(EAP_TYPES *i)
 253 {
 254         if (i->type->detach) (i->type->detach)(i->type_data);
 255         i->type_data = NULL;
 256         if (i->handle) lt_dlclose(i->handle);
 257         free(i);
 258 }
 259
 260
 261 void eaplist_free(rlm_eap_t *inst)
 262 {
 263         EAP_HANDLER *node, *next;
 264
 265         for (node = inst->session_head; node != NULL; node = next) {
 266                 next = node->next;
 267                 eap_handler_free(inst, node);
 268         }
 269
 270         inst->session_head = inst->session_tail = NULL;
 271 }
 272
 273 /*
 274  *      Return a 32-bit random number.
 275  */
 276 static uint32_t eap_rand(fr_randctx *ctx)
 277 {
 278         uint32_t num;
 279
 280         num = ctx->randrsl[ctx->randcnt++];
 281         if (ctx->randcnt >= 256) {
 282                 ctx->randcnt = 0;
 283                 fr_isaac(ctx);
 284         }
 285
 286         return num;
 287 }
 288
 289
 290 static EAP_HANDLER *eaplist_delete(rlm_eap_t *inst, REQUEST *request,
 291                                    EAP_HANDLER *handler)
 292 {
 293         rbnode_t *node;
 294
 295         node = rbtree_find(inst->session_tree, handler);
 296         if (!node) return NULL;
 297
 298         handler = rbtree_node2data(inst->session_tree, node);
 299
 300         RDEBUG("Finished EAP session with state "
 301                "0x%02x%02x%02x%02x%02x%02x%02x%02x",
 302                handler->state[0], handler->state[1],
 303                handler->state[2], handler->state[3],
 304                handler->state[4], handler->state[5],
 305                handler->state[6], handler->state[7]);
 306         /*
 307          *      Delete old handler from the tree.
 308          */
 309         rbtree_delete(inst->session_tree, node);
 310
 311         /*
 312          *      And unsplice it from the linked list.
 313          */
 314         if (handler->prev) {
 315                 handler->prev->next = handler->next;
 316         } else {
 317                 inst->session_head = handler->next;
 318         }
 319         if (handler->next) {
 320                 handler->next->prev = handler->prev;
 321         } else {
 322                 inst->session_tail = handler->prev;
 323         }
 324         handler->prev = handler->next = NULL;
 325
 326         return handler;
 327 }
 328
 329
 330 static void eaplist_expire(rlm_eap_t *inst, REQUEST *request, time_t timestamp)
 331 {
 332         int i;
 333         EAP_HANDLER *handler;
 334
 335         /*
 336          *      Check the first few handlers in the list, and delete
 337          *      them if they're too old.  We don't need to check them
 338          *      all, as incoming requests will quickly cause older
 339          *      handlers to be deleted.
 340          *
 341          */
 342         for (i = 0; i < 3; i++) {
 343                 handler = inst->session_head;
 344                 if (!handler) break;
 345
 346                 RDEBUG("Expiring EAP session with state "
 347                        "0x%02x%02x%02x%02x%02x%02x%02x%02x",
 348                        handler->state[0], handler->state[1],
 349                        handler->state[2], handler->state[3],
 350                        handler->state[4], handler->state[5],
 351                        handler->state[6], handler->state[7]);
 352
 353                 /*
 354                  *      Expire entries from the start of the list.
 355                  *      They should be the oldest ones.
 356                  */
 357                 if ((timestamp - handler->timestamp) > inst->timer_limit) {
 358                         rbnode_t *node;
 359                         node = rbtree_find(inst->session_tree, handler);
 360                         rad_assert(node != NULL);
 361                         rbtree_delete(inst->session_tree, node);
 362
 363                         /*
 364                          *      handler == inst->session_head
 365                          */
 366                         inst->session_head = handler->next;
 367                         if (handler->next) {
 368                                 handler->next->prev = NULL;
 369                         } else {
 370                                 inst->session_head = NULL;
 371                                 inst->session_tail = NULL;
 372                         }
 373                         eap_handler_free(inst, handler);
 374                 }
 375         }
 376 }
 377
 378 /*
 379  *      Add a handler to the set of active sessions.
 380  *
 381  *      Since we're adding it to the list, we guess that this means
 382  *      the packet needs a State attribute.  So add one.
 383  */
 384 int eaplist_add(rlm_eap_t *inst, EAP_HANDLER *handler)
 385 {
 386         int             status = 0;
 387         VALUE_PAIR      *state;
 388         REQUEST         *request = handler->request;
 389
 390         rad_assert(handler != NULL);
 391         rad_assert(request != NULL);
 392
 393         /*
 394          *      Generate State, since we've been asked to add it to
 395          *      the list.
 396          */
 397         state = pairmake("State", "0x00", T_OP_EQ);
 398         if (!state) return 0;
 399
 400         /*
 401          *      The time at which this request was made was the time
 402          *      at which it was received by the RADIUS server.
 403          */
 404         handler->timestamp = request->timestamp;
 405         handler->status = 1;
 406
 407         handler->src_ipaddr = request->packet->src_ipaddr;
 408         handler->eap_id = handler->eap_ds->request->id;
 409
 410         /*
 411          *      Playing with a data structure shared among threads
 412          *      means that we need a lock, to avoid conflict.
 413          */
 414         PTHREAD_MUTEX_LOCK(&(inst->session_mutex));
 415
 416         /*
 417          *      If we have a DoS attack, discard new sessions.
 418          */
 419         if (rbtree_num_elements(inst->session_tree) >= inst->max_sessions) {
 420                 status = -1;
 421                 eaplist_expire(inst, request, handler->timestamp);
 422                 goto done;
 423         }
 424
 425         /*
 426          *      Create a unique content for the State variable.
 427          *      It will be modified slightly per round trip, but less so
 428          *      than in 1.x.
 429          */
 430         if (handler->trips == 0) {
 431                 int i;
 432
 433                 for (i = 0; i < 4; i++) {
 434                         uint32_t lvalue;
 435
 436                         lvalue = eap_rand(&inst->rand_pool);
 437
 438                         memcpy(handler->state + i * 4, &lvalue,
 439                                sizeof(lvalue));
 440                 }
 441         }
 442
 443         memcpy(state->vp_octets, handler->state, sizeof(handler->state));
 444         state->length = EAP_STATE_LEN;
 445
 446         /*
 447          *      Add some more data to distinguish the sessions.
 448          */
 449         state->vp_octets[4] = handler->trips ^ handler->state[0];
 450         state->vp_octets[5] = handler->eap_id ^ handler->state[1];
 451         state->vp_octets[6] = handler->eap_type ^ handler->state[2];
 452
 453         /*
 454          *      and copy the state back again.
 455          */
 456         memcpy(handler->state, state->vp_octets, sizeof(handler->state));
 457
 458         /*
 459          *      Big-time failure.
 460          */
 461         status = rbtree_insert(inst->session_tree, handler);
 462
 463         /*
 464          *      Catch Access-Challenge without response.
 465          */
 466         if (inst->handler_tree) {
 467                 check_handler_t *check = rad_malloc(sizeof(*check));
 468
 469                 check->inst = inst;
 470                 check->handler = handler;
 471                 check->trips = handler->trips;
 472                 request_data_add(request, inst, 0, check, check_handler);
 473         }
 474
 475         if (status) {
 476                 EAP_HANDLER *prev;
 477
 478                 prev = inst->session_tail;
 479                 if (prev) {
 480                         prev->next = handler;
 481                         handler->prev = prev;
 482                         handler->next = NULL;
 483                         inst->session_tail = handler;
 484                 } else {
 485                         inst->session_head = inst->session_tail = handler;
 486                         handler->next = handler->prev = NULL;
 487                 }
 488         }
 489
 490         /*
 491          *      Now that we've finished mucking with the list,
 492          *      unlock it.
 493          */
 494  done:
 495
 496         /*
 497          *      We don't need this any more.
 498          */
 499         if (status > 0) handler->request = NULL;
 500
 501         PTHREAD_MUTEX_UNLOCK(&(inst->session_mutex));
 502
 503         if (status <= 0) {
 504                 pairfree(&state);
 505
 506                 if (status < 0) {
 507                         static time_t last_logged = 0;
 508
 509                         if (last_logged < handler->timestamp) {
 510                                 last_logged = handler->timestamp;
 511                                 radlog(L_ERR, "rlm_eap (%s): Too many open "
 512                                        "sessions.  Try increasing "
 513                                        "\"max_sessions\" in the EAP module "
 514                                        "configuration", inst->xlat_name);
 515                         }
 516                 } else {
 517                         radlog(L_ERR, "rlm_eap (%s): Internal error: "
 518                                "failed to store handler", inst->xlat_name);
 519                 }
 520                 return 0;
 521         }
 522
 523         RDEBUG("New EAP session, adding 'State' attribute to reply "
 524                "0x%02x%02x%02x%02x%02x%02x%02x%02x",
 525                state->vp_octets[0], state->vp_octets[1],
 526                state->vp_octets[2], state->vp_octets[3],
 527                state->vp_octets[4], state->vp_octets[5],
 528                state->vp_octets[6], state->vp_octets[7]);
 529
 530         pairadd(&(request->reply->vps), state);
 531
 532         return 1;
 533 }
 534
 535 /*
 536  *      Find a a previous EAP-Request sent by us, which matches
 537  *      the current EAP-Response.
 538  *
 539  *      Then, release the handle from the list, and return it to
 540  *      the caller.
 541  *
 542  *      Also since we fill the eap_ds with the present EAP-Response we
 543  *      got to free the prev_eapds & move the eap_ds to prev_eapds
 544  */
 545 EAP_HANDLER *eaplist_find(rlm_eap_t *inst, REQUEST *request,
 546                           eap_packet_t *eap_packet)
 547 {
 548         VALUE_PAIR      *state;
 549         EAP_HANDLER     *handler, myHandler;
 550
 551         /*
 552          *      We key the sessions off of the 'state' attribute, so it
 553          *      must exist.
 554          */
 555         state = pairfind(request->packet->vps, PW_STATE, 0, TAG_ANY);
 556         if (!state ||
 557             (state->length != EAP_STATE_LEN)) {
 558                 return NULL;
 559         }
 560
 561         myHandler.src_ipaddr = request->packet->src_ipaddr;
 562         myHandler.eap_id = eap_packet->id;
 563         memcpy(myHandler.state, state->vp_strvalue, sizeof(myHandler.state));
 564
 565         /*
 566          *      Playing with a data structure shared among threads
 567          *      means that we need a lock, to avoid conflict.
 568          */
 569         PTHREAD_MUTEX_LOCK(&(inst->session_mutex));
 570
 571         eaplist_expire(inst, request, request->timestamp);
 572
 573         handler = eaplist_delete(inst, request, &myHandler);
 574         PTHREAD_MUTEX_UNLOCK(&(inst->session_mutex));
 575
 576         /*
 577          *      Might not have been there.
 578          */
 579         if (!handler) {
 580                 radlog(L_ERR, "rlm_eap (%s): No EAP session matching state "
 581                        "0x%02x%02x%02x%02x%02x%02x%02x%02x",
 582                        inst->xlat_name,
 583                        state->vp_octets[0], state->vp_octets[1],
 584                        state->vp_octets[2], state->vp_octets[3],
 585                        state->vp_octets[4], state->vp_octets[5],
 586                        state->vp_octets[6], state->vp_octets[7]);
 587                 return NULL;
 588         }
 589
 590         if (handler->trips >= 50) {
 591                 radlog(L_ERR, "rlm_eap (%s): Aborting! More than 50 roundtrips "
 592                        "made in session with state "
 593                        "0x%02x%02x%02x%02x%02x%02x%02x%02x",
 594                        inst->xlat_name,
 595                        state->vp_octets[0], state->vp_octets[1],
 596                        state->vp_octets[2], state->vp_octets[3],
 597                        state->vp_octets[4], state->vp_octets[5],
 598                        state->vp_octets[6], state->vp_octets[7]);
 599
 600
 601                 eap_handler_free(inst, handler);
 602                 return NULL;
 603         }
 604         handler->trips++;
 605
 606         RDEBUG("Previous EAP request found for state "
 607                "0x%02x%02x%02x%02x%02x%02x%02x%02x, released from the list",
 608                 state->vp_octets[0], state->vp_octets[1],
 609                 state->vp_octets[2], state->vp_octets[3],
 610                 state->vp_octets[4], state->vp_octets[5],
 611                 state->vp_octets[6], state->vp_octets[7]);
 612
 613         /*
 614          *      Remember what the previous request was.
 615          */
 616         eap_ds_free(&(handler->prev_eapds));
 617         handler->prev_eapds = handler->eap_ds;
 618         handler->eap_ds = NULL;
 619
 620         return handler;
 621 }