src/modules/rlm_eap/mem.c

   1 /*
   2  * mem.c  Memory allocation, deallocation stuff.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2001,2006  The FreeRADIUS server project
  21  * Copyright 2001  hereUare Communications, Inc. <raghud@hereuare.com>
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include <stdio.h>
  28 #include "rlm_eap.h"
  29
  30 #ifdef HAVE_PTHREAD_H
  31 #define PTHREAD_MUTEX_LOCK pthread_mutex_lock
  32 #define PTHREAD_MUTEX_UNLOCK pthread_mutex_unlock
  33 #else
  34 #define PTHREAD_MUTEX_LOCK(_x)
  35 #define PTHREAD_MUTEX_UNLOCK(_x)
  36 #endif
  37
  38 /*
  39  * Allocate a new EAP_PACKET
  40  */
  41 EAP_PACKET *eap_packet_alloc(void)
  42 {
  43         EAP_PACKET   *rp;
  44
  45         rp = rad_malloc(sizeof(EAP_PACKET));
  46         memset(rp, 0, sizeof(EAP_PACKET));
  47         return rp;
  48 }
  49
  50 /*
  51  * Free EAP_PACKET
  52  */
  53 void eap_packet_free(EAP_PACKET **eap_packet_ptr)
  54 {
  55         EAP_PACKET *eap_packet;
  56
  57         if (!eap_packet_ptr) return;
  58         eap_packet = *eap_packet_ptr;
  59         if (!eap_packet) return;
  60
  61         if (eap_packet->type.data) {
  62                 /*
  63                  *      There's no packet, OR the type data isn't
  64                  *      pointing inside of the packet: free it.
  65                  */
  66                 if ((eap_packet->packet == NULL) ||
  67                     (eap_packet->type.data != (eap_packet->packet + 5))) {
  68                         free(eap_packet->type.data);
  69                 }
  70                 eap_packet->type.data = NULL;
  71         }
  72
  73         if (eap_packet->packet) {
  74                 free(eap_packet->packet);
  75                 eap_packet->packet = NULL;
  76         }
  77
  78         free(eap_packet);
  79
  80         *eap_packet_ptr = NULL;
  81 }
  82
  83 /*
  84  * Allocate a new EAP_PACKET
  85  */
  86 EAP_DS *eap_ds_alloc(void)
  87 {
  88         EAP_DS  *eap_ds;
  89
  90         eap_ds = rad_malloc(sizeof(EAP_DS));
  91         memset(eap_ds, 0, sizeof(EAP_DS));
  92         if ((eap_ds->response = eap_packet_alloc()) == NULL) {
  93                 eap_ds_free(&eap_ds);
  94                 return NULL;
  95         }
  96         if ((eap_ds->request = eap_packet_alloc()) == NULL) {
  97                 eap_ds_free(&eap_ds);
  98                 return NULL;
  99         }
 100
 101         return eap_ds;
 102 }
 103
 104 void eap_ds_free(EAP_DS **eap_ds_p)
 105 {
 106         EAP_DS *eap_ds;
 107
 108         if (!eap_ds_p) return;
 109
 110         eap_ds = *eap_ds_p;
 111         if (!eap_ds) return;
 112
 113         if (eap_ds->response) eap_packet_free(&(eap_ds->response));
 114         if (eap_ds->request) eap_packet_free(&(eap_ds->request));
 115
 116         free(eap_ds);
 117         *eap_ds_p = NULL;
 118 }
 119
 120 /*
 121  * Allocate a new EAP_HANDLER
 122  */
 123 EAP_HANDLER *eap_handler_alloc(rlm_eap_t *inst)
 124 {
 125         EAP_HANDLER     *handler;
 126
 127         handler = rad_malloc(sizeof(EAP_HANDLER));
 128         memset(handler, 0, sizeof(EAP_HANDLER));
 129
 130         if (inst->handler_tree) {
 131                 PTHREAD_MUTEX_LOCK(&(inst->handler_mutex));
 132                 rbtree_insert(inst->handler_tree, handler);
 133                 PTHREAD_MUTEX_UNLOCK(&(inst->handler_mutex));
 134
 135         }
 136         return handler;
 137 }
 138
 139 void eap_opaque_free(EAP_HANDLER *handler)
 140 {
 141         if (!handler)
 142                 return;
 143
 144         eap_handler_free(handler->inst_holder, handler);
 145 }
 146
 147 void eap_handler_free(rlm_eap_t *inst, EAP_HANDLER *handler)
 148 {
 149         if (!handler)
 150                 return;
 151
 152         if (inst->handler_tree) {
 153                 PTHREAD_MUTEX_LOCK(&(inst->handler_mutex));
 154                 rbtree_deletebydata(inst->handler_tree, handler);
 155                 PTHREAD_MUTEX_UNLOCK(&(inst->handler_mutex));
 156         }
 157
 158         if (handler->identity) {
 159                 free(handler->identity);
 160                 handler->identity = NULL;
 161         }
 162
 163         if (handler->prev_eapds) eap_ds_free(&(handler->prev_eapds));
 164         if (handler->eap_ds) eap_ds_free(&(handler->eap_ds));
 165
 166         if ((handler->opaque) && (handler->free_opaque)) {
 167                 handler->free_opaque(handler->opaque);
 168                 handler->opaque = NULL;
 169         }
 170         else if ((handler->opaque) && (handler->free_opaque == NULL))
 171                 radlog(L_ERR, "rlm_eap (%s): Possible memory leak ...",
 172                        inst->xlat_name);
 173
 174         handler->opaque = NULL;
 175         handler->free_opaque = NULL;
 176
 177         if (handler->certs) pairfree(&handler->certs);
 178
 179         free(handler);
 180 }
 181
 182
 183 typedef struct check_handler_t {
 184         rlm_eap_t       *inst;
 185         EAP_HANDLER     *handler;
 186         int             trips;
 187 } check_handler_t;
 188
 189 static void check_handler(void *data)
 190 {
 191         int do_warning = FALSE;
 192         uint8_t state[8];
 193         check_handler_t *check = data;
 194
 195         if (!check) return;
 196
 197         if (!check->inst || !check->handler) {
 198                 free(check);
 199                 return;
 200         }
 201
 202         if (!check->inst->handler_tree) goto done;
 203
 204         PTHREAD_MUTEX_LOCK(&(check->inst->handler_mutex));
 205         if (!rbtree_finddata(check->inst->handler_tree, check->handler)) {
 206                 goto done;
 207         }
 208
 209         /*
 210          *      The session has continued *after* this packet.
 211          *      Don't do a warning.
 212          */
 213         if (check->handler->trips > check->trips) {
 214                 goto done;
 215         }
 216
 217         /*
 218          *      No TLS means no warnings.
 219          */
 220         if (!check->handler->tls) goto done;
 221
 222         /*
 223          *      If we're being deleted early, it's likely because we
 224          *      received a transmit from the client that re-uses the
 225          *      same RADIUS Id, which forces the current packet to be
 226          *      deleted.  In that case, ignore the error.
 227          */
 228         if (time(NULL) < (check->handler->timestamp + 3)) goto done;
 229
 230         if (!check->handler->finished) {
 231                 do_warning = TRUE;
 232                 memcpy(state, check->handler->state, sizeof(state));
 233         }
 234
 235 done:
 236         PTHREAD_MUTEX_UNLOCK(&(check->inst->handler_mutex));
 237         free(check);
 238
 239         if (do_warning) {
 240                 DEBUGW("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 241                 DEBUGW("!! EAP session with state 0x%02x%02x%02x%02x%02x%02x%02x%02x did not finish!  !!",
 242                       state[0], state[1],
 243                       state[2], state[3],
 244                       state[4], state[5],
 245                       state[6], state[7]);
 246
 247                 DEBUGW("!! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility     !!");
 248                 DEBUGW("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 249         }
 250 }
 251
 252 void eaplist_free(rlm_eap_t *inst)
 253 {
 254         EAP_HANDLER *node, *next;
 255
 256         for (node = inst->session_head; node != NULL; node = next) {
 257                 next = node->next;
 258                 eap_handler_free(inst, node);
 259         }
 260
 261         inst->session_head = inst->session_tail = NULL;
 262 }
 263
 264 /*
 265  *      Return a 32-bit random number.
 266  */
 267 static uint32_t eap_rand(fr_randctx *ctx)
 268 {
 269         uint32_t num;
 270
 271         num = ctx->randrsl[ctx->randcnt++];
 272         if (ctx->randcnt >= 256) {
 273                 ctx->randcnt = 0;
 274                 fr_isaac(ctx);
 275         }
 276
 277         return num;
 278 }
 279
 280
 281 static EAP_HANDLER *eaplist_delete(rlm_eap_t *inst, REQUEST *request,
 282                                    EAP_HANDLER *handler)
 283 {
 284         rbnode_t *node;
 285
 286         node = rbtree_find(inst->session_tree, handler);
 287         if (!node) return NULL;
 288
 289         handler = rbtree_node2data(inst->session_tree, node);
 290
 291         RDEBUG("Finished EAP session with state "
 292                "0x%02x%02x%02x%02x%02x%02x%02x%02x",
 293                handler->state[0], handler->state[1],
 294                handler->state[2], handler->state[3],
 295                handler->state[4], handler->state[5],
 296                handler->state[6], handler->state[7]);
 297         /*
 298          *      Delete old handler from the tree.
 299          */
 300         rbtree_delete(inst->session_tree, node);
 301
 302         /*
 303          *      And unsplice it from the linked list.
 304          */
 305         if (handler->prev) {
 306                 handler->prev->next = handler->next;
 307         } else {
 308                 inst->session_head = handler->next;
 309         }
 310         if (handler->next) {
 311                 handler->next->prev = handler->prev;
 312         } else {
 313                 inst->session_tail = handler->prev;
 314         }
 315         handler->prev = handler->next = NULL;
 316
 317         return handler;
 318 }
 319
 320
 321 static void eaplist_expire(rlm_eap_t *inst, REQUEST *request, time_t timestamp)
 322 {
 323         int i;
 324         EAP_HANDLER *handler;
 325
 326         /*
 327          *      Check the first few handlers in the list, and delete
 328          *      them if they're too old.  We don't need to check them
 329          *      all, as incoming requests will quickly cause older
 330          *      handlers to be deleted.
 331          *
 332          */
 333         for (i = 0; i < 3; i++) {
 334                 handler = inst->session_head;
 335                 if (!handler) break;
 336
 337                 RDEBUG("Expiring EAP session with state "
 338                        "0x%02x%02x%02x%02x%02x%02x%02x%02x",
 339                        handler->state[0], handler->state[1],
 340                        handler->state[2], handler->state[3],
 341                        handler->state[4], handler->state[5],
 342                        handler->state[6], handler->state[7]);
 343
 344                 /*
 345                  *      Expire entries from the start of the list.
 346                  *      They should be the oldest ones.
 347                  */
 348                 if ((timestamp - handler->timestamp) > inst->timer_limit) {
 349                         rbnode_t *node;
 350                         node = rbtree_find(inst->session_tree, handler);
 351                         rad_assert(node != NULL);
 352                         rbtree_delete(inst->session_tree, node);
 353
 354                         /*
 355                          *      handler == inst->session_head
 356                          */
 357                         inst->session_head = handler->next;
 358                         if (handler->next) {
 359                                 handler->next->prev = NULL;
 360                         } else {
 361                                 inst->session_head = NULL;
 362                                 inst->session_tail = NULL;
 363                         }
 364                         eap_handler_free(inst, handler);
 365                 } else {
 366                         break;
 367                 }
 368         }
 369 }
 370
 371 /*
 372  *      Add a handler to the set of active sessions.
 373  *
 374  *      Since we're adding it to the list, we guess that this means
 375  *      the packet needs a State attribute.  So add one.
 376  */
 377 int eaplist_add(rlm_eap_t *inst, EAP_HANDLER *handler)
 378 {
 379         int             status = 0;
 380         VALUE_PAIR      *state;
 381         REQUEST         *request = handler->request;
 382
 383         rad_assert(handler != NULL);
 384         rad_assert(request != NULL);
 385
 386         /*
 387          *      Generate State, since we've been asked to add it to
 388          *      the list.
 389          */
 390         state = pairmake("State", "0x00", T_OP_EQ);
 391         if (!state) return 0;
 392
 393         /*
 394          *      The time at which this request was made was the time
 395          *      at which it was received by the RADIUS server.
 396          */
 397         handler->timestamp = request->timestamp;
 398         handler->status = 1;
 399
 400         handler->src_ipaddr = request->packet->src_ipaddr;
 401         handler->eap_id = handler->eap_ds->request->id;
 402
 403         /*
 404          *      Playing with a data structure shared among threads
 405          *      means that we need a lock, to avoid conflict.
 406          */
 407         PTHREAD_MUTEX_LOCK(&(inst->session_mutex));
 408
 409         /*
 410          *      If we have a DoS attack, discard new sessions.
 411          */
 412         if (rbtree_num_elements(inst->session_tree) >= inst->max_sessions) {
 413                 status = -1;
 414                 eaplist_expire(inst, request, handler->timestamp);
 415                 goto done;
 416         }
 417
 418         /*
 419          *      Create a unique content for the State variable.
 420          *      It will be modified slightly per round trip, but less so
 421          *      than in 1.x.
 422          */
 423         if (handler->trips == 0) {
 424                 int i;
 425
 426                 for (i = 0; i < 4; i++) {
 427                         uint32_t lvalue;
 428
 429                         lvalue = eap_rand(&inst->rand_pool);
 430
 431                         memcpy(handler->state + i * 4, &lvalue,
 432                                sizeof(lvalue));
 433                 }
 434         }
 435
 436         memcpy(state->vp_octets, handler->state, sizeof(handler->state));
 437         state->length = EAP_STATE_LEN;
 438
 439         /*
 440          *      Add some more data to distinguish the sessions.
 441          */
 442         state->vp_octets[4] = handler->trips ^ handler->state[0];
 443         state->vp_octets[5] = handler->eap_id ^ handler->state[1];
 444         state->vp_octets[6] = handler->eap_type ^ handler->state[2];
 445
 446         /*
 447          *      and copy the state back again.
 448          */
 449         memcpy(handler->state, state->vp_octets, sizeof(handler->state));
 450
 451         /*
 452          *      Big-time failure.
 453          */
 454         status = rbtree_insert(inst->session_tree, handler);
 455
 456         /*
 457          *      Catch Access-Challenge without response.
 458          */
 459         if (inst->handler_tree) {
 460                 check_handler_t *check = rad_malloc(sizeof(*check));
 461
 462                 check->inst = inst;
 463                 check->handler = handler;
 464                 check->trips = handler->trips;
 465                 request_data_add(request, inst, 0, check, check_handler);
 466         }
 467
 468         if (status) {
 469                 EAP_HANDLER *prev;
 470
 471                 prev = inst->session_tail;
 472                 if (prev) {
 473                         prev->next = handler;
 474                         handler->prev = prev;
 475                         handler->next = NULL;
 476                         inst->session_tail = handler;
 477                 } else {
 478                         inst->session_head = inst->session_tail = handler;
 479                         handler->next = handler->prev = NULL;
 480                 }
 481         }
 482
 483         /*
 484          *      Now that we've finished mucking with the list,
 485          *      unlock it.
 486          */
 487  done:
 488
 489         /*
 490          *      We don't need this any more.
 491          */
 492         if (status > 0) handler->request = NULL;
 493
 494         PTHREAD_MUTEX_UNLOCK(&(inst->session_mutex));
 495
 496         if (status <= 0) {
 497                 pairfree(&state);
 498
 499                 if (status < 0) {
 500                         static time_t last_logged = 0;
 501
 502                         if (last_logged < handler->timestamp) {
 503                                 last_logged = handler->timestamp;
 504                                 radlog(L_ERR, "rlm_eap (%s): Too many open "
 505                                        "sessions.  Try increasing "
 506                                        "\"max_sessions\" in the EAP module "
 507                                        "configuration", inst->xlat_name);
 508                         }
 509                 } else {
 510                         radlog(L_ERR, "rlm_eap (%s): Internal error: "
 511                                "failed to store handler", inst->xlat_name);
 512                 }
 513                 return 0;
 514         }
 515
 516         RDEBUG("New EAP session, adding 'State' attribute to reply "
 517                "0x%02x%02x%02x%02x%02x%02x%02x%02x",
 518                state->vp_octets[0], state->vp_octets[1],
 519                state->vp_octets[2], state->vp_octets[3],
 520                state->vp_octets[4], state->vp_octets[5],
 521                state->vp_octets[6], state->vp_octets[7]);
 522
 523         pairadd(&(request->reply->vps), state);
 524
 525         return 1;
 526 }
 527
 528 /*
 529  *      Find a a previous EAP-Request sent by us, which matches
 530  *      the current EAP-Response.
 531  *
 532  *      Then, release the handle from the list, and return it to
 533  *      the caller.
 534  *
 535  *      Also since we fill the eap_ds with the present EAP-Response we
 536  *      got to free the prev_eapds & move the eap_ds to prev_eapds
 537  */
 538 EAP_HANDLER *eaplist_find(rlm_eap_t *inst, REQUEST *request,
 539                           eap_packet_t *eap_packet)
 540 {
 541         VALUE_PAIR      *state;
 542         EAP_HANDLER     *handler, myHandler;
 543
 544         /*
 545          *      We key the sessions off of the 'state' attribute, so it
 546          *      must exist.
 547          */
 548         state = pairfind(request->packet->vps, PW_STATE, 0, TAG_ANY);
 549         if (!state ||
 550             (state->length != EAP_STATE_LEN)) {
 551                 return NULL;
 552         }
 553
 554         myHandler.src_ipaddr = request->packet->src_ipaddr;
 555         myHandler.eap_id = eap_packet->id;
 556         memcpy(myHandler.state, state->vp_strvalue, sizeof(myHandler.state));
 557
 558         /*
 559          *      Playing with a data structure shared among threads
 560          *      means that we need a lock, to avoid conflict.
 561          */
 562         PTHREAD_MUTEX_LOCK(&(inst->session_mutex));
 563
 564         eaplist_expire(inst, request, request->timestamp);
 565
 566         handler = eaplist_delete(inst, request, &myHandler);
 567         PTHREAD_MUTEX_UNLOCK(&(inst->session_mutex));
 568
 569         /*
 570          *      Might not have been there.
 571          */
 572         if (!handler) {
 573                 radlog(L_ERR, "rlm_eap (%s): No EAP session matching state "
 574                        "0x%02x%02x%02x%02x%02x%02x%02x%02x",
 575                        inst->xlat_name,
 576                        state->vp_octets[0], state->vp_octets[1],
 577                        state->vp_octets[2], state->vp_octets[3],
 578                        state->vp_octets[4], state->vp_octets[5],
 579                        state->vp_octets[6], state->vp_octets[7]);
 580                 return NULL;
 581         }
 582
 583         if (handler->trips >= 50) {
 584                 radlog(L_ERR, "rlm_eap (%s): Aborting! More than 50 roundtrips "
 585                        "made in session with state "
 586                        "0x%02x%02x%02x%02x%02x%02x%02x%02x",
 587                        inst->xlat_name,
 588                        state->vp_octets[0], state->vp_octets[1],
 589                        state->vp_octets[2], state->vp_octets[3],
 590                        state->vp_octets[4], state->vp_octets[5],
 591                        state->vp_octets[6], state->vp_octets[7]);
 592
 593
 594                 eap_handler_free(inst, handler);
 595                 return NULL;
 596         }
 597         handler->trips++;
 598
 599         RDEBUG("Previous EAP request found for state "
 600                "0x%02x%02x%02x%02x%02x%02x%02x%02x, released from the list",
 601                 state->vp_octets[0], state->vp_octets[1],
 602                 state->vp_octets[2], state->vp_octets[3],
 603                 state->vp_octets[4], state->vp_octets[5],
 604                 state->vp_octets[6], state->vp_octets[7]);
 605
 606         /*
 607          *      Remember what the previous request was.
 608          */
 609         eap_ds_free(&(handler->prev_eapds));
 610         handler->prev_eapds = handler->eap_ds;
 611         handler->eap_ds = NULL;
 612
 613         return handler;
 614 }