src/modules/rlm_eap/mem.c

   1 /*
   2  * mem.c  Memory allocation, deallocation stuff.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2001,2006  The FreeRADIUS server project
  21  * Copyright 2001  hereUare Communications, Inc. <raghud@hereuare.com>
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include <stdio.h>
  28 #include "rlm_eap.h"
  29
  30 /*
  31  * Allocate a new EAP_PACKET
  32  */
  33 EAP_PACKET *eap_packet_alloc(void)
  34 {
  35         EAP_PACKET   *rp;
  36
  37         rp = rad_malloc(sizeof(EAP_PACKET));
  38         memset(rp, 0, sizeof(EAP_PACKET));
  39         return rp;
  40 }
  41
  42 /*
  43  * Free EAP_PACKET
  44  */
  45 void eap_packet_free(EAP_PACKET **eap_packet_ptr)
  46 {
  47         EAP_PACKET *eap_packet;
  48
  49         if (!eap_packet_ptr) return;
  50         eap_packet = *eap_packet_ptr;
  51         if (!eap_packet) return;
  52
  53         if (eap_packet->type.data) {
  54                 /*
  55                  *      There's no packet, OR the type data isn't
  56                  *      pointing inside of the packet: free it.
  57                  */
  58                 if ((eap_packet->packet == NULL) ||
  59                     (eap_packet->type.data != (eap_packet->packet + 5))) {
  60                         free(eap_packet->type.data);
  61                 }
  62                 eap_packet->type.data = NULL;
  63         }
  64
  65         if (eap_packet->packet) {
  66                 free(eap_packet->packet);
  67                 eap_packet->packet = NULL;
  68         }
  69
  70         free(eap_packet);
  71
  72         *eap_packet_ptr = NULL;
  73 }
  74
  75 /*
  76  * Allocate a new EAP_PACKET
  77  */
  78 EAP_DS *eap_ds_alloc(void)
  79 {
  80         EAP_DS  *eap_ds;
  81
  82         eap_ds = rad_malloc(sizeof(EAP_DS));
  83         memset(eap_ds, 0, sizeof(EAP_DS));
  84         if ((eap_ds->response = eap_packet_alloc()) == NULL) {
  85                 eap_ds_free(&eap_ds);
  86                 return NULL;
  87         }
  88         if ((eap_ds->request = eap_packet_alloc()) == NULL) {
  89                 eap_ds_free(&eap_ds);
  90                 return NULL;
  91         }
  92
  93         return eap_ds;
  94 }
  95
  96 void eap_ds_free(EAP_DS **eap_ds_p)
  97 {
  98         EAP_DS *eap_ds;
  99
 100         if (!eap_ds_p) return;
 101
 102         eap_ds = *eap_ds_p;
 103         if (!eap_ds) return;
 104
 105         if (eap_ds->response) eap_packet_free(&(eap_ds->response));
 106         if (eap_ds->request) eap_packet_free(&(eap_ds->request));
 107
 108         free(eap_ds);
 109         *eap_ds_p = NULL;
 110 }
 111
 112 /*
 113  * Allocate a new EAP_HANDLER
 114  */
 115 EAP_HANDLER *eap_handler_alloc(rlm_eap_t *inst)
 116 {
 117         EAP_HANDLER     *handler;
 118
 119         handler = rad_malloc(sizeof(EAP_HANDLER));
 120         memset(handler, 0, sizeof(EAP_HANDLER));
 121
 122         if (fr_debug_flag && inst->handler_tree) {
 123                 pthread_mutex_lock(&(inst->session_mutex));
 124                 rbtree_insert(inst->handler_tree, handler);
 125                 pthread_mutex_unlock(&(inst->session_mutex));
 126
 127         }
 128         return handler;
 129 }
 130
 131 void eap_handler_free(rlm_eap_t *inst, EAP_HANDLER *handler)
 132 {
 133         if (!handler)
 134                 return;
 135
 136         if (inst->handler_tree) {
 137                 pthread_mutex_lock(&(inst->session_mutex));
 138                 rbtree_deletebydata(inst->handler_tree, handler);
 139                 pthread_mutex_unlock(&(inst->session_mutex));
 140         }
 141
 142         if (handler->identity) {
 143                 free(handler->identity);
 144                 handler->identity = NULL;
 145         }
 146
 147         if (handler->prev_eapds) eap_ds_free(&(handler->prev_eapds));
 148         if (handler->eap_ds) eap_ds_free(&(handler->eap_ds));
 149
 150         if ((handler->opaque) && (handler->free_opaque)) {
 151                 handler->free_opaque(handler->opaque);
 152                 handler->opaque = NULL;
 153         }
 154         else if ((handler->opaque) && (handler->free_opaque == NULL))
 155                 radlog(L_ERR, "Possible memory leak ...");
 156
 157         handler->opaque = NULL;
 158         handler->free_opaque = NULL;
 159
 160         free(handler);
 161 }
 162
 163
 164 typedef struct check_handler_t {
 165         rlm_eap_t       *inst;
 166         EAP_HANDLER     *handler;
 167         int             trips;
 168 } check_handler_t;
 169
 170 static void check_handler(void *data)
 171 {
 172         check_handler_t *check = data;
 173
 174         if (!check) return;
 175         if (!check->inst || !check->handler) {
 176                 free(check);
 177                 return;
 178         }
 179
 180         pthread_mutex_lock(&(check->inst->session_mutex));
 181         if (!rbtree_finddata(check->inst->handler_tree, check->handler)) {
 182                 goto done;
 183         }
 184
 185         if (check->handler->trips > check->trips) {
 186                 goto done;
 187         }
 188
 189         if (check->handler->tls && !check->handler->finished) {
 190                 DEBUG("WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 191                 DEBUG("WARNING: !! EAP session for state 0x%02x%02x%02x%02x%02x%02x%02x%02x did not finish!",
 192                       check->handler->state[0], check->handler->state[1],
 193                       check->handler->state[2], check->handler->state[3],
 194                       check->handler->state[4], check->handler->state[5],
 195                       check->handler->state[6], check->handler->state[7]);
 196
 197                 DEBUG("WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility");
 198                 DEBUG("WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 199         }
 200
 201 done:
 202         pthread_mutex_unlock(&(check->inst->session_mutex));
 203         free(check);
 204 }
 205
 206 void eaptype_free(EAP_TYPES *i)
 207 {
 208         if (i->type->detach) (i->type->detach)(i->type_data);
 209         i->type_data = NULL;
 210         if (i->handle) lt_dlclose(i->handle);
 211         free(i);
 212 }
 213
 214
 215 void eaplist_free(rlm_eap_t *inst)
 216 {
 217         EAP_HANDLER *node, *next;
 218
 219         for (node = inst->session_head; node != NULL; node = next) {
 220                 next = node->next;
 221                 eap_handler_free(inst, node);
 222         }
 223
 224         inst->session_head = inst->session_tail = NULL;
 225 }
 226
 227 /*
 228  *      Return a 32-bit random number.
 229  */
 230 static uint32_t eap_rand(fr_randctx *ctx)
 231 {
 232         uint32_t num;
 233
 234         num = ctx->randrsl[ctx->randcnt++];
 235         if (ctx->randcnt >= 256) {
 236                 ctx->randcnt = 0;
 237                 fr_isaac(ctx);
 238         }
 239
 240         return num;
 241 }
 242
 243
 244 static EAP_HANDLER *eaplist_delete(rlm_eap_t *inst, EAP_HANDLER *handler)
 245 {
 246         rbnode_t *node;
 247
 248         node = rbtree_find(inst->session_tree, handler);
 249         if (!node) return NULL;
 250
 251         handler = rbtree_node2data(inst->session_tree, node);
 252
 253         /*
 254          *      Delete old handler from the tree.
 255          */
 256         rbtree_delete(inst->session_tree, node);
 257
 258         /*
 259          *      And unsplice it from the linked list.
 260          */
 261         if (handler->prev) {
 262                 handler->prev->next = handler->next;
 263         } else {
 264                 inst->session_head = handler->next;
 265         }
 266         if (handler->next) {
 267                 handler->next->prev = handler->prev;
 268         } else {
 269                 inst->session_tail = handler->prev;
 270         }
 271         handler->prev = handler->next = NULL;
 272
 273         return handler;
 274 }
 275
 276
 277 static void eaplist_expire(rlm_eap_t *inst, time_t timestamp)
 278 {
 279         int i;
 280         EAP_HANDLER *handler;
 281
 282         /*
 283          *      Check the first few handlers in the list, and delete
 284          *      them if they're too old.  We don't need to check them
 285          *      all, as incoming requests will quickly cause older
 286          *      handlers to be deleted.
 287          *
 288          */
 289         for (i = 0; i < 3; i++) {
 290                 handler = inst->session_head;
 291                 if (!handler) break;
 292
 293                 /*
 294                  *      Expire entries from the start of the list.
 295                  *      They should be the oldest ones.
 296                  */
 297                 if ((timestamp - handler->timestamp) > inst->timer_limit) {
 298                         rbnode_t *node;
 299                         node = rbtree_find(inst->session_tree, handler);
 300                         rad_assert(node != NULL);
 301                         rbtree_delete(inst->session_tree, node);
 302
 303                         /*
 304                          *      handler == inst->session_head
 305                          */
 306                         inst->session_head = handler->next;
 307                         if (handler->next) {
 308                                 handler->next->prev = NULL;
 309                         } else {
 310                                 inst->session_head = NULL;
 311                                 inst->session_tail = NULL;
 312                         }
 313                         eap_handler_free(inst, handler);
 314                 }
 315         }
 316 }
 317
 318 /*
 319  *      Add a handler to the set of active sessions.
 320  *
 321  *      Since we're adding it to the list, we guess that this means
 322  *      the packet needs a State attribute.  So add one.
 323  */
 324 int eaplist_add(rlm_eap_t *inst, EAP_HANDLER *handler)
 325 {
 326         int             status = 0;
 327         VALUE_PAIR      *state;
 328         REQUEST         *request = handler->request;
 329
 330         rad_assert(handler != NULL);
 331         rad_assert(request != NULL);
 332
 333         /*
 334          *      Generate State, since we've been asked to add it to
 335          *      the list.
 336          */
 337         state = pairmake("State", "0x00", T_OP_EQ);
 338         if (!state) return 0;
 339
 340         /*
 341          *      The time at which this request was made was the time
 342          *      at which it was received by the RADIUS server.
 343          */
 344         handler->timestamp = request->timestamp;
 345         handler->status = 1;
 346
 347         handler->src_ipaddr = request->packet->src_ipaddr;
 348         handler->eap_id = handler->eap_ds->request->id;
 349
 350         /*
 351          *      Playing with a data structure shared among threads
 352          *      means that we need a lock, to avoid conflict.
 353          */
 354         pthread_mutex_lock(&(inst->session_mutex));
 355
 356         /*
 357          *      If we have a DoS attack, discard new sessions.
 358          */
 359         if (rbtree_num_elements(inst->session_tree) >= inst->max_sessions) {
 360                 status = -1;
 361                 eaplist_expire(inst, handler->timestamp);
 362                 goto done;
 363         }
 364
 365         /*
 366          *      Create a unique content for the State variable.
 367          *      It will be modified slightly per round trip, but less so
 368          *      than in 1.x.
 369          */
 370         if (handler->trips == 0) {
 371                 int i;
 372
 373                 for (i = 0; i < 4; i++) {
 374                         uint32_t lvalue;
 375
 376                         lvalue = eap_rand(&inst->rand_pool);
 377
 378                         memcpy(handler->state + i * 4, &lvalue,
 379                                sizeof(lvalue));
 380                 }
 381         }
 382
 383         memcpy(state->vp_octets, handler->state, sizeof(handler->state));
 384         state->length = EAP_STATE_LEN;
 385
 386         /*
 387          *      Add some more data to distinguish the sessions.
 388          */
 389         state->vp_octets[4] = handler->trips ^ handler->state[0];
 390         state->vp_octets[5] = handler->eap_id ^ handler->state[1];
 391         state->vp_octets[6] = handler->eap_type ^ handler->state[2];
 392
 393         /*
 394          *      and copy the state back again.
 395          */
 396         memcpy(handler->state, state->vp_octets, sizeof(handler->state));
 397
 398         /*
 399          *      Big-time failure.
 400          */
 401         status = rbtree_insert(inst->session_tree, handler);
 402
 403         /*
 404          *      Catch Access-Challenge without response.
 405          */
 406         if (fr_debug_flag) {
 407                 check_handler_t *check = rad_malloc(sizeof(*check));
 408
 409                 check->inst = inst;
 410                 check->handler = handler;
 411                 check->trips = handler->trips;
 412                 request_data_add(request, inst, 0, check, check_handler);
 413         }
 414
 415         if (status) {
 416                 EAP_HANDLER *prev;
 417
 418                 prev = inst->session_tail;
 419                 if (prev) {
 420                         prev->next = handler;
 421                         handler->prev = prev;
 422                         handler->next = NULL;
 423                         inst->session_tail = handler;
 424                 } else {
 425                         inst->session_head = inst->session_tail = handler;
 426                         handler->next = handler->prev = NULL;
 427                 }
 428         }
 429
 430         /*
 431          *      Now that we've finished mucking with the list,
 432          *      unlock it.
 433          */
 434  done:
 435
 436         /*
 437          *      We don't need this any more.
 438          */
 439         if (status > 0) handler->request = NULL;
 440
 441         pthread_mutex_unlock(&(inst->session_mutex));
 442
 443         if (status <= 0) {
 444                 pairfree(&state);
 445
 446                 if (status < 0) {
 447                         static time_t last_logged = 0;
 448
 449                         if (last_logged < handler->timestamp) {
 450                                 last_logged = handler->timestamp;
 451                                 radlog(L_ERR, "rlm_eap: Too many open sessions.  Try increasing \"max_sessions\" in the EAP module configuration");
 452                         }
 453                 } else {
 454                         radlog(L_ERR, "rlm_eap: Internal error: failed to store handler");
 455                 }
 456                 return 0;
 457         }
 458
 459         pairadd(&(request->reply->vps), state);
 460
 461         return 1;
 462 }
 463
 464 /*
 465  *      Find a a previous EAP-Request sent by us, which matches
 466  *      the current EAP-Response.
 467  *
 468  *      Then, release the handle from the list, and return it to
 469  *      the caller.
 470  *
 471  *      Also since we fill the eap_ds with the present EAP-Response we
 472  *      got to free the prev_eapds & move the eap_ds to prev_eapds
 473  */
 474 EAP_HANDLER *eaplist_find(rlm_eap_t *inst, REQUEST *request,
 475                           eap_packet_t *eap_packet)
 476 {
 477         VALUE_PAIR      *state;
 478         EAP_HANDLER     *handler, myHandler;
 479
 480         /*
 481          *      We key the sessions off of the 'state' attribute, so it
 482          *      must exist.
 483          */
 484         state = pairfind(request->packet->vps, PW_STATE, 0);
 485         if (!state ||
 486             (state->length != EAP_STATE_LEN)) {
 487                 return NULL;
 488         }
 489
 490         myHandler.src_ipaddr = request->packet->src_ipaddr;
 491         myHandler.eap_id = eap_packet->id;
 492         memcpy(myHandler.state, state->vp_strvalue, sizeof(myHandler.state));
 493
 494         /*
 495          *      Playing with a data structure shared among threads
 496          *      means that we need a lock, to avoid conflict.
 497          */
 498         pthread_mutex_lock(&(inst->session_mutex));
 499
 500         eaplist_expire(inst, request->timestamp);
 501
 502         handler = eaplist_delete(inst, &myHandler);
 503         pthread_mutex_unlock(&(inst->session_mutex));
 504
 505         /*
 506          *      Might not have been there.
 507          */
 508         if (!handler) {
 509                 radlog(L_ERR, "rlm_eap: No EAP session matching the State variable.");
 510                 return NULL;
 511         }
 512
 513         if (handler->trips >= 50) {
 514                 RDEBUG2("More than 50 authentication packets for this EAP session.  Aborted.");
 515                 eap_handler_free(inst, handler);
 516                 return NULL;
 517         }
 518         handler->trips++;
 519
 520         RDEBUG2("Request found, released from the list");
 521
 522         /*
 523          *      Remember what the previous request was.
 524          */
 525         eap_ds_free(&(handler->prev_eapds));
 526         handler->prev_eapds = handler->eap_ds;
 527         handler->eap_ds = NULL;
 528
 529         return handler;
 530 }