/* Bugs:
* TCP accounting not yet supported
* We are not removing client requests from dynamic servers, see removeclientrqs()
+ * Need to remove UDP clients when no activity for a while...
+ * Remove expired stuff from clients request list?
*/
#include <signal.h>
int confserver_cb(struct gconffile **cf, void *arg, char *block, char *opt, char *val);
void freerealm(struct realm *realm);
void freeclsrvconf(struct clsrvconf *conf);
-void freerqdata(struct request *rq);
+void freerq(struct request *rq);
+void freerqoutdata(struct rqout *rqout);
static const struct protodefs protodefs[] = {
{ "udp", /* UDP, assuming RAD_UDP defined as 0 */
10, /* retrycountmax */
REQUEST_RETRY_INTERVAL, /* retryintervaldefault */
60, /* retryintervalmax */
+ DUPLICATE_INTERVAL, /* duplicateintervaldefault */
udpserverrd, /* listener */
&options.sourceudp, /* srcaddrport */
NULL, /* connecter */
0, /* retrycountmax */
REQUEST_RETRY_INTERVAL * REQUEST_RETRY_COUNT, /* retryintervaldefault */
60, /* retryintervalmax */
+ DUPLICATE_INTERVAL, /* duplicateintervaldefault */
tlslistener, /* listener */
&options.sourcetls, /* srcaddrport */
tlsconnect, /* connecter */
0, /* retrycountmax */
REQUEST_RETRY_INTERVAL * REQUEST_RETRY_COUNT, /* retryintervaldefault */
60, /* retryintervalmax */
+ DUPLICATE_INTERVAL, /* duplicateintervaldefault */
tcplistener, /* listener */
&options.sourcetcp, /* srcaddrport */
tcpconnect, /* connecter */
10, /* retrycountmax */
REQUEST_RETRY_INTERVAL, /* retryintervaldefault */
60, /* retryintervalmax */
+ DUPLICATE_INTERVAL, /* duplicateintervaldefault */
udpdtlsserverrd, /* listener */
&options.sourcedtls, /* srcaddrport */
dtlsconnect, /* connecter */
removequeue(q);
}
-struct client *addclient(struct clsrvconf *conf) {
+struct client *addclient(struct clsrvconf *conf, uint8_t lock) {
struct client *new = malloc(sizeof(struct client));
if (!new) {
debug(DBG_ERR, "malloc failed");
return NULL;
}
+
+ if (lock)
+ pthread_mutex_lock(conf->lock);
if (!conf->clients) {
conf->clients = list_create();
if (!conf->clients) {
+ if (lock)
+ pthread_mutex_unlock(conf->lock);
debug(DBG_ERR, "malloc failed");
return NULL;
}
}
memset(new, 0, sizeof(struct client));
+ pthread_mutex_init(&new->lock, NULL);
new->conf = conf;
if (conf->pdef->addclient)
conf->pdef->addclient(new);
else
new->replyq = newqueue();
list_push(conf->clients, new);
+ if (lock)
+ pthread_mutex_unlock(conf->lock);
return new;
}
void removeclient(struct client *client) {
- if (!client || !client->conf->clients)
+ if (!client)
return;
- removequeue(client->replyq);
- list_removedata(client->conf->clients, client);
- free(client);
+
+ pthread_mutex_lock(client->conf->lock);
+ if (client->conf->clients) {
+ pthread_mutex_lock(&client->lock);
+ removequeue(client->replyq);
+ list_removedata(client->conf->clients, client);
+ pthread_mutex_unlock(&client->lock);
+ pthread_mutex_destroy(&client->lock);
+ free(client->addr);
+ free(client);
+ }
+ pthread_mutex_unlock(client->conf->lock);
}
void removeclientrqs(struct client *client) {
struct list_node *entry;
struct server *server;
- struct request *rq;
+ struct rqout *rqout;
int i;
for (entry = list_first(srvconfs); entry; entry = list_next(entry)) {
continue;
pthread_mutex_lock(&server->newrq_mutex);
for (i = 0; i < MAX_REQUESTS; i++) {
- rq = server->requests + i;
- if (rq->from == client)
- rq->from = NULL;
+ rqout = server->requests + i;
+ if (rqout->rq && rqout->rq->from == client) {
+ freerq(rqout->rq);
+ rqout->rq = NULL;
+ }
}
pthread_mutex_unlock(&server->newrq_mutex);
}
}
void freeserver(struct server *server, uint8_t destroymutex) {
- struct request *rq, *end;
+ struct rqout *rqout, *end;
if (!server)
return;
if (server->requests) {
- rq = server->requests;
- for (end = rq + MAX_REQUESTS; rq < end; rq++)
- freerqdata(rq);
+ rqout = server->requests;
+ for (end = rqout + MAX_REQUESTS; rqout < end; rqout++)
+ freerqoutdata(rqout);
free(server->requests);
}
if (server->rbios)
if (conf->pdef->addserverextra)
conf->pdef->addserverextra(conf);
- conf->servers->requests = calloc(MAX_REQUESTS, sizeof(struct request));
+ conf->servers->requests = calloc(MAX_REQUESTS, sizeof(struct rqout));
if (!conf->servers->requests) {
debug(DBG_ERR, "malloc failed");
goto errexit;
return 1;
}
-int radsign(unsigned char *rad, unsigned char *sec) {
- static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
- static unsigned char first = 1;
- static EVP_MD_CTX mdctx;
- unsigned int md_len;
- int result;
-
- pthread_mutex_lock(&lock);
- if (first) {
- EVP_MD_CTX_init(&mdctx);
- first = 0;
- }
-
- result = (EVP_DigestInit_ex(&mdctx, EVP_md5(), NULL) &&
- EVP_DigestUpdate(&mdctx, rad, RADLEN(rad)) &&
- EVP_DigestUpdate(&mdctx, sec, strlen((char *)sec)) &&
- EVP_DigestFinal_ex(&mdctx, rad + 4, &md_len) &&
- md_len == 16);
- pthread_mutex_unlock(&lock);
- return result;
-}
-
-int validauth(unsigned char *rad, unsigned char *reqauth, unsigned char *sec) {
- static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
- static unsigned char first = 1;
- static EVP_MD_CTX mdctx;
- unsigned char hash[EVP_MAX_MD_SIZE];
- unsigned int len;
- int result;
-
- pthread_mutex_lock(&lock);
- if (first) {
- EVP_MD_CTX_init(&mdctx);
- first = 0;
- }
-
- len = RADLEN(rad);
-
- result = (EVP_DigestInit_ex(&mdctx, EVP_md5(), NULL) &&
- EVP_DigestUpdate(&mdctx, rad, 4) &&
- EVP_DigestUpdate(&mdctx, reqauth, 16) &&
- (len <= 20 || EVP_DigestUpdate(&mdctx, rad + 20, len - 20)) &&
- EVP_DigestUpdate(&mdctx, sec, strlen((char *)sec)) &&
- EVP_DigestFinal_ex(&mdctx, hash, &len) &&
- len == 16 &&
- !memcmp(hash, rad + 4, 16));
- pthread_mutex_unlock(&lock);
- return result;
-}
-
-int checkmessageauth(unsigned char *rad, uint8_t *authattr, char *secret) {
- static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
- static unsigned char first = 1;
- static HMAC_CTX hmacctx;
- unsigned int md_len;
- uint8_t auth[16], hash[EVP_MAX_MD_SIZE];
-
- pthread_mutex_lock(&lock);
- if (first) {
- HMAC_CTX_init(&hmacctx);
- first = 0;
- }
-
- memcpy(auth, authattr, 16);
- memset(authattr, 0, 16);
- md_len = 0;
- HMAC_Init_ex(&hmacctx, secret, strlen(secret), EVP_md5(), NULL);
- HMAC_Update(&hmacctx, rad, RADLEN(rad));
- HMAC_Final(&hmacctx, hash, &md_len);
- memcpy(authattr, auth, 16);
- if (md_len != 16) {
- debug(DBG_WARN, "message auth computation failed");
- pthread_mutex_unlock(&lock);
- return 0;
- }
-
- if (memcmp(auth, hash, 16)) {
- debug(DBG_WARN, "message authenticator, wrong value");
- pthread_mutex_unlock(&lock);
- return 0;
- }
-
- pthread_mutex_unlock(&lock);
- return 1;
-}
-
-int createmessageauth(unsigned char *rad, unsigned char *authattrval, char *secret) {
- static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
- static unsigned char first = 1;
- static HMAC_CTX hmacctx;
- unsigned int md_len;
-
- if (!authattrval)
- return 1;
-
- pthread_mutex_lock(&lock);
- if (first) {
- HMAC_CTX_init(&hmacctx);
- first = 0;
- }
-
- memset(authattrval, 0, 16);
- md_len = 0;
- HMAC_Init_ex(&hmacctx, secret, strlen(secret), EVP_md5(), NULL);
- HMAC_Update(&hmacctx, rad, RADLEN(rad));
- HMAC_Final(&hmacctx, authattrval, &md_len);
- if (md_len != 16) {
- debug(DBG_WARN, "message auth computation failed");
- pthread_mutex_unlock(&lock);
- return 0;
- }
-
- pthread_mutex_unlock(&lock);
- return 1;
-}
-
unsigned char *attrget(unsigned char *attrs, int length, uint8_t type) {
while (length > 1) {
if (ATTRTYPE(attrs) == type)
}
void freerqdata(struct request *rq) {
- if (rq->origusername)
- free(rq->origusername);
+ if (!rq)
+ return;
if (rq->buf)
free(rq->buf);
}
-void sendrq(struct server *to, struct request *rq) {
+void freerq(struct request *rq) {
+ if (!rq)
+ return;
+ debug(DBG_DBG, "freerq: called with refcount %d", rq->refcount);
+ if (--rq->refcount)
+ return;
+ freerqdata(rq);
+ free(rq);
+}
+
+void freerqoutdata(struct rqout *rqout) {
+ if (!rqout)
+ return;
+ if (rqout->origusername)
+ free(rqout->origusername);
+ if (rqout->msg)
+ radmsg_free(rqout->msg);
+ if (rqout->buf)
+ free(rqout->buf);
+ if (rqout->rq)
+ freerq(rqout->rq);
+}
+
+void sendrq(struct server *to, struct rqout *rqout) {
int i;
- uint8_t *attr;
pthread_mutex_lock(&to->newrq_mutex);
/* might simplify if only try nextid, might be ok */
break;
if (i == to->nextid) {
debug(DBG_WARN, "sendrq: no room in queue, dropping request");
- freerqdata(rq);
+ freerqoutdata(rqout);
goto exit;
}
}
-
- rq->buf[1] = (char)i;
- attr = attrget(rq->buf + 20, RADLEN(rq->buf) - 20, RAD_Attr_Message_Authenticator);
- if (attr && !createmessageauth(rq->buf, ATTRVAL(attr), to->conf->secret)) {
- freerqdata(rq);
+ rqout->msg->id = (uint8_t)i;
+ rqout->buf = radmsg2buf(rqout->msg, (uint8_t *)to->conf->secret);
+ if (!rqout->buf) {
+ debug(DBG_ERR, "sendrq: radmsg2buf failed");
+ freerqoutdata(rqout);
goto exit;
}
- if (*rq->buf == RAD_Accounting_Request) {
- if (!radsign(rq->buf, (unsigned char *)to->conf->secret)) {
- debug(DBG_WARN, "sendrq: failed to sign Accounting-Request message");
- freerqdata(rq);
- goto exit;
- }
- }
-
debug(DBG_DBG, "sendrq: inserting packet with id %d in queue for %s", i, to->conf->host);
- to->requests[i] = *rq;
+ to->requests[i] = *rqout;
to->nextid = i + 1;
if (!to->newrq) {
debug(DBG_DBG, "sendrq: signalling client writer");
pthread_cond_signal(&to->newrq_cond);
}
+
exit:
pthread_mutex_unlock(&to->newrq_mutex);
}
-void sendreply(struct client *to, unsigned char *buf, struct sockaddr_storage *tosa, int toudpsock) {
+void sendreply(struct client *to, struct radmsg *msg, struct sockaddr_storage *tosa, int toudpsock) {
+ uint8_t *buf;
struct reply *reply;
uint8_t first;
-
- if (!radsign(buf, (unsigned char *)to->conf->secret)) {
- free(buf);
- debug(DBG_WARN, "sendreply: failed to sign message");
+
+ buf = radmsg2buf(msg, (uint8_t *)to->conf->secret);
+ radmsg_free(msg);
+ if (!buf) {
+ debug(DBG_ERR, "sendreply: radmsg2buf failed");
return;
}
}
int rqinqueue(struct server *to, struct client *from, uint8_t id, uint8_t code) {
- struct request *rq = to->requests, *end;
+ struct rqout *rqout = to->requests, *end;
pthread_mutex_lock(&to->newrq_mutex);
- for (end = rq + MAX_REQUESTS; rq < end; rq++)
- if (rq->buf && !rq->received && rq->origid == id && rq->from == from && *rq->buf == code)
+ for (end = rqout + MAX_REQUESTS; rqout < end; rqout++)
+ if (rqout->buf && !rqout->received && rqout->origid == id && rqout->rq && rqout->rq->from == from && *rqout->buf == code)
break;
pthread_mutex_unlock(&to->newrq_mutex);
- return rq < end;
+ return rqout < end;
}
int attrvalidate(unsigned char *attrs, int length) {
return 1;
}
-int msmppe(unsigned char *attrs, int length, uint8_t type, char *attrtxt, struct request *rq,
+int msmppe(unsigned char *attrs, int length, uint8_t type, char *attrtxt, struct rqout *rq,
char *oldsecret, char *newsecret) {
unsigned char *attr;
return 0;
}
-int dovendorrewriterm(uint8_t *attrs, uint16_t length, uint32_t *removevendorattrs) {
- uint8_t alen, sublen, rmlen = 0;
- uint32_t vendor = *(uint32_t *)ATTRVAL(attrs);
+/* returns 1 if entire element is to be removed, else 0 */
+int dovendorrewriterm(struct tlv *attr, uint32_t *removevendorattrs) {
+ uint8_t alen, sublen;
+ uint32_t vendor;
uint8_t *subattrs;
if (!removevendorattrs)
return 0;
+ memcpy(&vendor, attr->v, 4);
+ vendor = ntohl(vendor);
while (*removevendorattrs && *removevendorattrs != vendor)
removevendorattrs += 2;
if (!*removevendorattrs)
return 0;
- alen = ATTRLEN(attrs);
-
- if (findvendorsubattr(removevendorattrs, vendor, -1)) {
- /* remove entire vendor attribute */
- memmove(attrs, attrs + alen, length - alen);
- return alen;
- }
+ if (findvendorsubattr(removevendorattrs, vendor, -1))
+ return 1; /* remove entire vendor attribute */
- sublen = alen - 4;
- subattrs = ATTRVAL(attrs) + 4;
+ sublen = attr->l - 4;
+ subattrs = attr->v + 4;
if (!attrvalidate(subattrs, sublen)) {
debug(DBG_WARN, "dovendorrewrite: vendor attribute validation failed, no rewrite");
return 0;
}
- length -= 6;
while (sublen > 1) {
alen = ATTRLEN(subattrs);
sublen -= alen;
- length -= alen;
if (findvendorsubattr(removevendorattrs, vendor, ATTRTYPE(subattrs))) {
- memmove(subattrs, subattrs + alen, length);
- rmlen += alen;
+ memmove(subattrs, subattrs + alen, sublen);
+ attr->l -= alen;
} else
subattrs += alen;
}
-
- ATTRLEN(attrs) -= rmlen;
- return rmlen;
+ return 0;
}
-void dorewriterm(uint8_t *buf, uint8_t *rmattrs, uint32_t *rmvattrs) {
- uint8_t *attrs, alen;
- uint16_t len, rmlen = 0;
-
- len = RADLEN(buf) - 20;
- attrs = buf + 20;
- while (len > 1) {
- alen = ATTRLEN(attrs);
- len -= alen;
- if (rmattrs && strchr((char *)rmattrs, ATTRTYPE(attrs))) {
- memmove(attrs, attrs + alen, len);
- rmlen += alen;
- } else if (ATTRTYPE(attrs) == RAD_Attr_Vendor_Specific && rmvattrs)
- rmlen += dovendorrewriterm(attrs, len, rmvattrs);
- else
- attrs += alen;
+void dorewriterm(struct radmsg *msg, uint8_t *rmattrs, uint32_t *rmvattrs) {
+ struct list_node *n, *p;
+ struct tlv *attr;
+
+ p = NULL;
+ n = list_first(msg->attrs);
+ while (n) {
+ attr = (struct tlv *)n->data;
+ if ((rmattrs && strchr((char *)rmattrs, attr->t)) ||
+ (rmvattrs && attr->t == RAD_Attr_Vendor_Specific && dovendorrewriterm(attr, rmvattrs))) {
+ list_removedata(msg->attrs, attr);
+ freetlv(attr);
+ n = p ? list_next(p) : list_first(msg->attrs);
+ } else
+ p = n;
+ n = list_next(n);
}
- if (rmlen)
- ((uint16_t *)buf)[1] = htons(RADLEN(buf) - rmlen);
}
-int dorewriteadd(uint8_t **buf, struct list *addattrs) {
+int dorewriteadd(struct radmsg *msg, struct list *addattrs) {
struct list_node *n;
- struct attribute *a;
- uint16_t i, addlen = 0;
- uint8_t *newbuf;
+ struct tlv *a;
- for (n = list_first(addattrs); n; n = list_next(n))
- addlen += 2 + ((struct attribute *)n->data)->l;
- if (!addlen)
- return 1;
- newbuf = realloc(*buf, RADLEN(*buf) + addlen);
- if (!newbuf)
- return 0;
-
- i = RADLEN(newbuf);
for (n = list_first(addattrs); n; n = list_next(n)) {
- a = (struct attribute *)n->data;
- newbuf[i++] = a->t;
- newbuf[i++] = a->l + 2;
- memcpy(newbuf + i, a->v, a->l);
- i += a->l;
- }
- ((uint16_t *)newbuf)[1] = htons(RADLEN(newbuf) + addlen);
- *buf = newbuf;
+ a = copytlv((struct tlv *)n->data);
+ if (!a)
+ return 0;
+ if (!radmsg_add(msg, a)) {
+ freetlv(a);
+ return 0;
+ }
+ }
return 1;
}
-/* returns a pointer to the resized attribute value */
-uint8_t *resizeattr(uint8_t **buf, uint8_t **attr, uint8_t newvallen) {
- uint8_t vallen;
- uint16_t len;
- unsigned char *new;
+int resizeattr(struct tlv *attr, uint8_t newlen) {
+ uint8_t *newv;
- vallen = ATTRVALLEN(*attr);
- if (vallen == newvallen)
- return *attr + 2;
-
- len = RADLEN(*buf) + newvallen - vallen;
-
- if (newvallen > vallen) {
- new = realloc(*buf, len);
- if (!new) {
- debug(DBG_ERR, "resizeattr: malloc failed");
- return NULL;
- }
- if (new != *buf) {
- *attr += new - *buf;
- *buf = new;
- }
+ if (newlen != attr->l) {
+ newv = realloc(attr->v, newlen);
+ if (!newv)
+ return 0;
+ attr->v = newv;
+ attr->l = newlen;
}
- memmove(*attr + 2 + newvallen, *attr + 2 + vallen, len - (*attr - *buf + newvallen));
- (*attr)[1] = newvallen + 2;
- ((uint16_t *)*buf)[1] = htons(len);
- return *attr + 2;
+ return 1;
}
-int dorewritemodattr(uint8_t **buf, uint8_t **attr, struct modattr *modattr) {
+int dorewritemodattr(struct tlv *attr, struct modattr *modattr) {
size_t nmatch = 10, reslen = 0, start = 0;
regmatch_t pmatch[10], *pfield;
int i;
- unsigned char *result;
char *in, *out;
- in = stringcopy((char *)ATTRVAL(*attr), ATTRVALLEN(*attr));
+ in = stringcopy((char *)attr->v, attr->l);
if (!in)
return 0;
free(in);
return 0;
}
- result = resizeattr(buf, attr, reslen);
- if (!result) {
+
+ if (!resizeattr(attr, reslen)) {
free(in);
return 0;
}
-
+
start = 0;
reslen = 0;
for (i = start; out[i]; i++) {
if (out[i] == '\\' && out[i + 1] >= '1' && out[i + 1] <= '9') {
pfield = &pmatch[out[i + 1] - '0'];
if (pfield->rm_so >= 0) {
- memcpy(result + reslen, out + start, i - start);
+ memcpy(attr->v + reslen, out + start, i - start);
reslen += i - start;
- memcpy(result + reslen, in + pfield->rm_so, pfield->rm_eo - pfield->rm_so);
+ memcpy(attr->v + reslen, in + pfield->rm_so, pfield->rm_eo - pfield->rm_so);
reslen += pfield->rm_eo - pfield->rm_so;
start = i + 2;
}
}
}
- memcpy(result + reslen, out + start, i - start);
+ memcpy(attr->v + reslen, out + start, i - start);
return 1;
}
-
-int dorewritemod(uint8_t **buf, struct list *modattrs) {
- uint8_t *attr;
- uint16_t len = 0;
- struct list_node *n;
- attr = *buf + 20;
- while (RADLEN(*buf) - 22 >= len) {
- for (n = list_first(modattrs); n; n = list_next(n))
- if (ATTRTYPE(attr) == ((struct modattr *)n->data)->t)
- if (!dorewritemodattr(buf, &attr, (struct modattr *)n->data))
- return 0;
- len += ATTRLEN(attr);
- attr += ATTRLEN(attr);
- }
+int dorewritemod(struct radmsg *msg, struct list *modattrs) {
+ struct list_node *n, *m;
+
+ for (n = list_first(msg->attrs); n; n = list_next(n))
+ for (m = list_first(modattrs); m; m = list_next(m))
+ if (((struct tlv *)n->data)->t == ((struct modattr *)m->data)->t &&
+ !dorewritemodattr((struct tlv *)n->data, (struct modattr *)m->data))
+ return 0;
return 1;
}
-int dorewrite(uint8_t **buf, struct rewrite *rewrite) {
+int dorewrite(struct radmsg *msg, struct rewrite *rewrite) {
if (!rewrite)
return 1;
if (rewrite->removeattrs || rewrite->removevendorattrs)
- dorewriterm(*buf, rewrite->removeattrs, rewrite->removevendorattrs);
- if (rewrite->addattrs && !dorewriteadd(buf, rewrite->addattrs))
+ dorewriterm(msg, rewrite->removeattrs, rewrite->removevendorattrs);
+ if (rewrite->addattrs && !dorewriteadd(msg, rewrite->addattrs))
return 0;
- if (rewrite->modattrs && !dorewritemod(buf, rewrite->modattrs))
+ if (rewrite->modattrs && !dorewritemod(msg, rewrite->modattrs))
return 0;
return 1;
}
-
-int rewriteusername(struct request *rq, uint8_t *attr, char *in) {
- if (!dorewritemodattr(&rq->buf, &attr, rq->from->conf->rewriteusername))
- return 0;
- if (strlen(in) == ATTRVALLEN(attr) && !memcmp(in, ATTRVAL(attr), ATTRVALLEN(attr)))
- return 1;
- rq->origusername = stringcopy(in, 0);
- if (!rq->origusername)
+int rewriteusername(struct rqout *rqout, struct tlv *attr) {
+ char *orig = (char *)tlv2str(attr);
+ if (!dorewritemodattr(attr, rqout->rq->from->conf->rewriteusername)) {
+ free(orig);
return 0;
-
- memcpy(in, ATTRVAL(attr), ATTRVALLEN(attr));
- in[ATTRVALLEN(attr)] = '\0';
+ }
+ if (strlen(orig) != attr->l || memcmp(orig, attr->v, attr->l))
+ rqout->origusername = (char *)orig;
+ else
+ free(orig);
return 1;
}
return;
}
-char *radattr2ascii(char *ascii, size_t len, unsigned char *attr) {
+uint8_t *radattr2ascii(struct tlv *attr) {
int i, l;
- char *s, *d;
+ uint8_t *a, *d;
- if (!attr || len == 1) {
- *ascii = '\0';
- return ascii;
- }
+ if (!attr)
+ return NULL;
- l = ATTRVALLEN(attr);
- s = (char *)ATTRVAL(attr);
- d = ascii;
+ l = attr->l;
+ for (i = 0; i < attr->l; i++)
+ if (attr->v[i] < 32 || attr->v[i] > 126)
+ l += 2;
+ if (l == attr->l)
+ return (uint8_t *)stringcopy((char *)attr->v, attr->l);
+
+ a = malloc(l + 1);
+ if (!a)
+ return NULL;
- for (i = 0; i < l; i++) {
- if (s[i] > 31 && s[i] < 127) {
- *d++ = s[i];
- if (d - ascii == len - 1)
- break;
- } else {
- if (d - ascii > len - 4)
- break;
+ d = a;
+ for (i = 0; i < attr->l; i++)
+ if (attr->v[i] < 32 || attr->v[i] > 126) {
*d++ = '%';
- char2hex(d, s[i]);
+ char2hex((char *)d, attr->v[i]);
d += 2;
- if (d - ascii == len - 1)
- break;
- }
- }
+ } else
+ *d++ = attr->v[i];
*d = '\0';
- return ascii;
+ return a;
}
-void acclog(unsigned char *attrs, int length, char *host) {
- unsigned char *attr;
- char username[760];
+void acclog(struct radmsg *msg, char *host) {
+ struct tlv *attr;
+ uint8_t *username;
- attr = attrget(attrs, length, RAD_Attr_User_Name);
+ attr = radmsg_gettype(msg, RAD_Attr_User_Name);
if (!attr) {
debug(DBG_INFO, "acclog: accounting-request from %s without username attribute", host);
return;
}
- radattr2ascii(username, sizeof(username), attr);
- debug(DBG_INFO, "acclog: accounting-request from %s with username: %s", host, username);
+ username = radattr2ascii(attr);
+ if (username) {
+ debug(DBG_INFO, "acclog: accounting-request from %s with username: %s", host, username);
+ free(username);
+ }
}
-
-void respondaccounting(struct request *rq) {
- unsigned char *resp;
- resp = malloc(20);
- if (!resp) {
+void respondaccounting(struct rqout *rqout) {
+ struct radmsg *msg;
+
+ msg = radmsg_init(RAD_Accounting_Response, rqout->msg->id, rqout->msg->auth);
+ if (msg) {
+ debug(DBG_DBG, "respondaccounting: responding to %s", rqout->rq->from->conf->host);
+ sendreply(rqout->rq->from, msg, &rqout->rq->fromsa, rqout->rq->fromudpsock);
+ } else
debug(DBG_ERR, "respondaccounting: malloc failed");
- return;
- }
- memcpy(resp, rq->buf, 20);
- resp[0] = RAD_Accounting_Response;
- resp[2] = 0;
- resp[3] = 20;
- debug(DBG_DBG, "respondaccounting: responding to %s", rq->from->conf->host);
- sendreply(rq->from, resp, &rq->fromsa, rq->fromudpsock);
}
-void respondstatusserver(struct request *rq) {
- unsigned char *resp;
+void respondstatusserver(struct rqout *rqout) {
+ struct radmsg *msg;
- resp = malloc(20);
- if (!resp) {
+ msg = radmsg_init(RAD_Access_Accept, rqout->msg->id, rqout->msg->auth);
+ if (msg) {
+ debug(DBG_DBG, "respondstatusserver: responding to %s", rqout->rq->from->conf->host);
+ sendreply(rqout->rq->from, msg, &rqout->rq->fromsa, rqout->rq->fromudpsock);
+ } else
debug(DBG_ERR, "respondstatusserver: malloc failed");
- return;
- }
- memcpy(resp, rq->buf, 20);
- resp[0] = RAD_Access_Accept;
- resp[2] = 0;
- resp[3] = 20;
- debug(DBG_DBG, "respondstatusserver: responding to %s", rq->from->conf->host);
- sendreply(rq->from, resp, &rq->fromsa, rq->fromudpsock);
}
-void respondreject(struct request *rq, char *message) {
- unsigned char *resp;
- int len = 20;
+void respondreject(struct rqout *rqout, char *message) {
+ struct radmsg *msg;
+ struct tlv *attr;
- if (message && *message)
- len += 2 + strlen(message);
-
- resp = malloc(len);
- if (!resp) {
+ msg = radmsg_init(RAD_Access_Reject, rqout->msg->id, rqout->msg->auth);
+ if (!msg) {
debug(DBG_ERR, "respondreject: malloc failed");
return;
}
- memcpy(resp, rq->buf, 20);
- resp[0] = RAD_Access_Reject;
- *(uint16_t *)(resp + 2) = htons(len);
if (message && *message) {
- resp[20] = RAD_Attr_Reply_Message;
- resp[21] = len - 20;
- memcpy(resp + 22, message, len - 22);
+ attr = maketlv(RAD_Attr_Reply_Message, strlen(message), message);
+ if (!attr || !radmsg_add(msg, attr)) {
+ freetlv(attr);
+ radmsg_free(msg);
+ debug(DBG_ERR, "respondreject: malloc failed");
+ return;
+ }
}
- sendreply(rq->from, resp, &rq->fromsa, rq->fromudpsock);
+
+ debug(DBG_DBG, "respondreject: responding to %s", rqout->rq->from->conf->host);
+ sendreply(rqout->rq->from, msg, &rqout->rq->fromsa, rqout->rq->fromudpsock);
}
struct clsrvconf *choosesrvconf(struct list *srvconfs) {
return best ? best : first;
}
-struct server *findserver(struct realm **realm, char *id, uint8_t acc) {
+struct server *findserver(struct realm **realm, struct tlv *username, uint8_t acc) {
struct clsrvconf *srvconf;
+ char *id = (char *)tlv2str(username);
+ if (!id)
+ return NULL;
*realm = id2realm(realms, id);
- if (!*realm)
+ if (!*realm) {
+ free(id);
return NULL;
+ }
debug(DBG_DBG, "found matching realm: %s", (*realm)->name);
srvconf = choosesrvconf(acc ? (*realm)->accsrvconfs : (*realm)->srvconfs);
- if (!srvconf)
+ if (!srvconf) {
+ free(id);
return NULL;
+ }
if (!acc && !srvconf->servers)
adddynamicrealmserver(*realm, srvconf, id);
+ free(id);
return srvconf->servers;
}
+
+struct request *newrequest() {
+ struct request *rq;
+
+ rq = malloc(sizeof(struct request));
+ if (!rq) {
+ debug(DBG_ERR, "newrequest: malloc failed");
+ return NULL;
+ }
+ memset(rq, 0, sizeof(struct request));
+ rq->refcount = 1;
+ gettimeofday(&rq->created, NULL);
+ return rq;
+}
+
+int addclientrq(struct request *rq, uint8_t id) {
+ struct request *r;
+ struct timeval now;
+
+ pthread_mutex_lock(&rq->from->lock);
+ gettimeofday(&now, NULL);
+ r = rq->from->rqs[id];
+ if (r) {
+ if (r->refcount > 1 && now.tv_sec - r->created.tv_sec < r->from->conf->dupinterval) {
+ pthread_mutex_unlock(&rq->from->lock);
+ return 0;
+ }
+ freerq(r);
+ }
+ rq->refcount++;
+ rq->from->rqs[id] = rq;
+ pthread_mutex_unlock(&rq->from->lock);
+ return 1;
+}
+
+void rmclientrq(struct request *rq, uint8_t id) {
+ struct request *r;
+
+ pthread_mutex_lock(&rq->from->lock);
+ r = rq->from->rqs[id];
+ if (r) {
+ freerq(r);
+ rq->from->rqs[id] = NULL;
+ }
+ pthread_mutex_unlock(&rq->from->lock);
+}
+
/* returns 0 if validation/authentication fails, else 1 */
int radsrv(struct request *rq) {
- uint8_t code, id, *auth, *attrs, *attr;
- uint16_t len;
- struct server *to = NULL;
- char username[254], userascii[760];
+ struct radmsg *msg = NULL;
+ struct rqout *rqout, rqdata;
+ struct tlv *attr;
+ uint8_t *userascii = NULL;
unsigned char newauth[16];
struct realm *realm = NULL;
+ struct server *to = NULL;
+ struct client *from = rq->from;
- code = *(uint8_t *)rq->buf;
- id = *(uint8_t *)(rq->buf + 1);
- len = RADLEN(rq->buf);
- auth = (uint8_t *)(rq->buf + 4);
+ msg = buf2radmsg(rq->buf, (uint8_t *)from->conf->secret, NULL);
+ if (!msg) {
+ debug(DBG_WARN, "radsrv: message validation failed, ignoring packet");
+ return 0;
+ }
- debug(DBG_DBG, "radsrv: code %d, id %d, length %d", code, id, len);
+ rqout = &rqdata;
+ memset(rqout, 0, sizeof(struct rqout));
+ rqout->msg = msg;
+ debug(DBG_DBG, "radsrv: code %d, id %d", msg->code, msg->id);
- if (code != RAD_Access_Request && code != RAD_Status_Server && code != RAD_Accounting_Request) {
+ if (msg->code != RAD_Access_Request && msg->code != RAD_Status_Server && msg->code != RAD_Accounting_Request) {
debug(DBG_INFO, "radsrv: server currently accepts only access-requests, accounting-requests and status-server, ignoring");
- goto exit;
- }
-
- len -= 20;
- attrs = rq->buf + 20;
-
- if (!attrvalidate(attrs, len)) {
- debug(DBG_WARN, "radsrv: attribute validation failed, ignoring packet");
- goto errvalauth;
+ freerqoutdata(rqout);
+ return 1;
}
- attr = attrget(attrs, len, RAD_Attr_Message_Authenticator);
- if (attr && (ATTRVALLEN(attr) != 16 || !checkmessageauth(rq->buf, ATTRVAL(attr), rq->from->conf->secret))) {
- debug(DBG_WARN, "radsrv: message authentication failed");
- goto errvalauth;
+ if (!addclientrq(rq, msg->id)) {
+ debug(DBG_INFO, "radsrv: already got request with id %d from %s, ignoring", msg->id, from->conf->host);
+ freerqoutdata(rqout);
+ return 1;
}
-
- if (code == RAD_Status_Server) {
- respondstatusserver(rq);
+ rqout->rq = rq;
+ rq->refcount++;
+
+ if (msg->code == RAD_Status_Server) {
+ respondstatusserver(rqout);
goto exit;
}
-
+
/* below: code == RAD_Access_Request || code == RAD_Accounting_Request */
- if (code == RAD_Accounting_Request) {
- memset(newauth, 0, 16);
- if (!validauth(rq->buf, newauth, (unsigned char *)rq->from->conf->secret)) {
- debug(DBG_WARN, "radsrv: Accounting-Request message authentication failed");
- goto errvalauth;
- }
- }
-
- if (rq->from->conf->rewritein) {
- if (!dorewrite(&rq->buf, rq->from->conf->rewritein))
- goto exit;
- len = RADLEN(rq->buf) - 20;
- auth = (uint8_t *)(rq->buf + 4);
- attrs = rq->buf + 20;
- }
-
- attr = attrget(attrs, len, RAD_Attr_User_Name);
+ if (from->conf->rewritein && !dorewrite(msg, from->conf->rewritein))
+ goto exit;
+
+ attr = radmsg_gettype(msg, RAD_Attr_User_Name);
if (!attr) {
- if (code == RAD_Accounting_Request) {
- acclog(attrs, len, rq->from->conf->host);
- respondaccounting(rq);
+ if (msg->code == RAD_Accounting_Request) {
+ acclog(msg, from->conf->host);
+ respondaccounting(rqout);
} else
debug(DBG_WARN, "radsrv: ignoring access request, no username attribute");
goto exit;
}
- memcpy(username, ATTRVAL(attr), ATTRVALLEN(attr));
- username[ATTRVALLEN(attr)] = '\0';
- radattr2ascii(userascii, sizeof(userascii), attr);
-
- if (rq->from->conf->rewriteusername) {
- if (!rewriteusername(rq, attr, username)) {
- debug(DBG_WARN, "radsrv: username malloc failed, ignoring request");
- goto exit;
- }
- len = RADLEN(rq->buf) - 20;
- auth = (uint8_t *)(rq->buf + 4);
- attrs = rq->buf + 20;
+
+ if (from->conf->rewriteusername && !rewriteusername(rqout, attr)) {
+ debug(DBG_WARN, "radsrv: username malloc failed, ignoring request");
+ goto exit;
}
-
- debug(DBG_DBG, "%s with username: %s", radmsgtype2string(code), userascii);
- to = findserver(&realm, username, code == RAD_Accounting_Request);
+ userascii = radattr2ascii(attr);
+ if (!userascii)
+ goto exit;
+ debug(DBG_DBG, "%s with username: %s", radmsgtype2string(msg->code), userascii);
+
+ to = findserver(&realm, attr, msg->code == RAD_Accounting_Request);
if (!realm) {
debug(DBG_INFO, "radsrv: ignoring request, don't know where to send it");
goto exit;
}
if (!to) {
- if (realm->message && code == RAD_Access_Request) {
- debug(DBG_INFO, "radsrv: sending reject to %s for %s", rq->from->conf->host, userascii);
- respondreject(rq, realm->message);
- } else if (realm->accresp && code == RAD_Accounting_Request) {
- acclog(attrs, len, rq->from->conf->host);
- respondaccounting(rq);
+ if (realm->message && msg->code == RAD_Access_Request) {
+ debug(DBG_INFO, "radsrv: sending reject to %s for %s", from->conf->host, userascii);
+ respondreject(rqout, realm->message);
+ } else if (realm->accresp && msg->code == RAD_Accounting_Request) {
+ acclog(msg, from->conf->host);
+ respondaccounting(rqout);
}
goto exit;
}
- if (options.loopprevention && !strcmp(rq->from->conf->name, to->conf->name)) {
+ free(rq->buf);
+ rq->buf = NULL;
+
+ if (options.loopprevention && !strcmp(from->conf->name, to->conf->name)) {
debug(DBG_INFO, "radsrv: Loop prevented, not forwarding request from client %s to server %s, discarding",
- rq->from->conf->name, to->conf->name);
+ from->conf->name, to->conf->name);
goto exit;
}
- if (rqinqueue(to, rq->from, id, code)) {
+#if 0
+ skip this now that we have rqrcv... per client?
+ if (rqinqueue(to, from, msg->id, msg->code)) {
debug(DBG_INFO, "radsrv: already got %s from host %s with id %d, ignoring",
- radmsgtype2string(code), rq->from->conf->host, id);
+ radmsgtype2string(msg->code), from->conf->host, msg->id);
goto exit;
}
+#endif
- if (code != RAD_Accounting_Request) {
+ if (msg->code != RAD_Accounting_Request) {
if (!RAND_bytes(newauth, 16)) {
debug(DBG_WARN, "radsrv: failed to generate random auth");
goto exit;
}
}
-
+
#ifdef DEBUG
printfchars(NULL, "auth", "%02x ", auth, 16);
#endif
- attr = attrget(attrs, len, RAD_Attr_User_Password);
+ attr = radmsg_gettype(msg, RAD_Attr_User_Password);
if (attr) {
- debug(DBG_DBG, "radsrv: found userpwdattr with value length %d", ATTRVALLEN(attr));
- if (!pwdrecrypt(ATTRVAL(attr), ATTRVALLEN(attr), rq->from->conf->secret, to->conf->secret, auth, newauth))
+ debug(DBG_DBG, "radsrv: found userpwdattr with value length %d", attr->l);
+ if (!pwdrecrypt(attr->v, attr->l, from->conf->secret, to->conf->secret, msg->auth, newauth))
goto exit;
}
-
- attr = attrget(attrs, len, RAD_Attr_Tunnel_Password);
+
+ attr = radmsg_gettype(msg, RAD_Attr_Tunnel_Password);
if (attr) {
- debug(DBG_DBG, "radsrv: found tunnelpwdattr with value length %d", ATTRVALLEN(attr));
- if (!pwdrecrypt(ATTRVAL(attr), ATTRVALLEN(attr), rq->from->conf->secret, to->conf->secret, auth, newauth))
+ debug(DBG_DBG, "radsrv: found tunnelpwdattr with value length %d", attr->l);
+ if (!pwdrecrypt(attr->v, attr->l, from->conf->secret, to->conf->secret, msg->auth, newauth))
goto exit;
}
- rq->origid = id;
- memcpy(rq->origauth, auth, 16);
- memcpy(auth, newauth, 16);
+ rqout->origid = msg->id;
+ memcpy(rqout->origauth, msg->auth, 16);
+ memcpy(msg->auth, newauth, 16);
- if (to->conf->rewriteout)
- if (!dorewrite(&rq->buf, to->conf->rewriteout))
- goto exit;
+ if (to->conf->rewriteout && !dorewrite(msg, to->conf->rewriteout))
+ goto exit;
- sendrq(to, rq);
+ free(userascii);
+ sendrq(to, rqout);
return 1;
exit:
- freerqdata(rq);
+ rmclientrq(rq, msg->id);
+ free(userascii);
+ freerqoutdata(rqout);
return 1;
-
- errvalauth:
- freerqdata(rq);
- return 0;
}
-int replyh(struct server *server, unsigned char *buf) {
+void replyh(struct server *server, unsigned char *buf) {
struct client *from;
- struct request *rq;
- int i, len, sublen;
- unsigned char *messageauth, *subattrs, *attrs, *attr, *username;
+ struct rqout *rqout;
+ int sublen;
+ unsigned char *subattrs;
struct sockaddr_storage fromsa;
- char tmp[760], stationid[760];
+ uint8_t *username, *stationid;
+ struct radmsg *msg = NULL;
+ struct tlv *attr;
+ struct list_node *node;
server->connectionok = 1;
server->lostrqs = 0;
-
- i = buf[1]; /* i is the id */
- if (*buf != RAD_Access_Accept && *buf != RAD_Access_Reject && *buf != RAD_Access_Challenge
- && *buf != RAD_Accounting_Response) {
- debug(DBG_INFO, "replyh: discarding message type %s, accepting only access accept, access reject, access challenge and accounting response messages", radmsgtype2string(*buf));
- return 0;
+ rqout = server->requests + buf[1];
+ msg = buf2radmsg(buf, (uint8_t *)server->conf->secret, rqout->msg->auth);
+ free(buf);
+ buf = NULL;
+ if (!msg) {
+ debug(DBG_WARN, "replyh: message validation failed, ignoring packet");
+ return;
}
- debug(DBG_DBG, "got %s message with id %d", radmsgtype2string(*buf), i);
-
- rq = server->requests + i;
+ if (msg->code != RAD_Access_Accept && msg->code != RAD_Access_Reject && msg->code != RAD_Access_Challenge
+ && msg->code != RAD_Accounting_Response) {
+ debug(DBG_INFO, "replyh: discarding message type %s, accepting only access accept, access reject, access challenge and accounting response messages", radmsgtype2string(msg->code));
+ radmsg_free(msg);
+ return;
+ }
+ debug(DBG_DBG, "got %s message with id %d", radmsgtype2string(msg->code), msg->id);
pthread_mutex_lock(&server->newrq_mutex);
- if (!rq->buf || !rq->tries) {
- pthread_mutex_unlock(&server->newrq_mutex);
+ if (!rqout->buf || !rqout->tries) {
debug(DBG_INFO, "replyh: no matching request sent with this id, ignoring reply");
- return 0;
+ goto errunlock;
}
- if (rq->received) {
- pthread_mutex_unlock(&server->newrq_mutex);
+ if (rqout->received) {
debug(DBG_INFO, "replyh: already received, ignoring reply");
- return 0;
+ goto errunlock;
}
- if (!validauth(buf, rq->buf + 4, (unsigned char *)server->conf->secret)) {
- pthread_mutex_unlock(&server->newrq_mutex);
- debug(DBG_WARN, "replyh: invalid auth, ignoring reply");
- return 0;
- }
-
- len = RADLEN(buf) - 20;
- attrs = buf + 20;
-
- if (!attrvalidate(attrs, len)) {
- pthread_mutex_unlock(&server->newrq_mutex);
- debug(DBG_WARN, "replyh: attribute validation failed, ignoring reply");
- return 0;
- }
-
- /* Message Authenticator */
- messageauth = attrget(attrs, len, RAD_Attr_Message_Authenticator);
- if (messageauth) {
- if (ATTRVALLEN(messageauth) != 16) {
- pthread_mutex_unlock(&server->newrq_mutex);
- debug(DBG_WARN, "replyh: illegal message auth attribute length, ignoring reply");
- return 0;
- }
- memcpy(tmp, buf + 4, 16);
- memcpy(buf + 4, rq->buf + 4, 16);
- if (!checkmessageauth(buf, ATTRVAL(messageauth), server->conf->secret)) {
- pthread_mutex_unlock(&server->newrq_mutex);
- debug(DBG_WARN, "replyh: message authentication failed, ignoring reply");
- return 0;
- }
- memcpy(buf + 4, tmp, 16);
- debug(DBG_DBG, "replyh: message auth ok");
- }
-
gettimeofday(&server->lastrcv, NULL);
- if (*rq->buf == RAD_Status_Server) {
- rq->received = 1;
- pthread_mutex_unlock(&server->newrq_mutex);
+ if (rqout->msg->code == RAD_Status_Server) {
+ rqout->received = 1;
debug(DBG_DBG, "replyh: got status server response from %s", server->conf->host);
- return 0;
+ goto errunlock;
}
gettimeofday(&server->lastreply, NULL);
- from = rq->from;
- if (!from) {
- pthread_mutex_unlock(&server->newrq_mutex);
+ if (!rqout->rq) {
debug(DBG_INFO, "replyh: client gone, ignoring reply");
- return 0;
+ goto errunlock;
}
+ from = rqout->rq->from;
- if (server->conf->rewritein) {
- if (!dorewrite(&buf, server->conf->rewritein))
- return 0;
- len = RADLEN(buf) - 20;
- attrs = buf + 20;
- if (messageauth)
- messageauth = attrget(attrs, len, RAD_Attr_Message_Authenticator);
+ if (server->conf->rewritein && !dorewrite(msg, from->conf->rewritein)) {
+ debug(DBG_WARN, "replyh: rewritein failed");
+ goto errunlock;
}
/* MS MPPE */
- for (attr = attrs; (attr = attrget(attr, len - (attr - attrs), RAD_Attr_Vendor_Specific)); attr += ATTRLEN(attr)) {
- if (ATTRVALLEN(attr) <= 4)
+ for (node = list_first(msg->attrs); node; node = list_next(node)) {
+ attr = (struct tlv *)node->data;
+ if (attr->t != RAD_Attr_Vendor_Specific)
+ continue;
+ if (attr->l <= 4)
break;
-
- if (attr[2] != 0 || attr[3] != 0 || attr[4] != 1 || attr[5] != 55) /* 311 == MS */
+ if (attr->v[0] != 0 || attr->v[1] != 0 || attr->v[2] != 1 || attr->v[3] != 55) /* 311 == MS */
continue;
- sublen = ATTRVALLEN(attr) - 4;
- subattrs = ATTRVAL(attr) + 4;
+ sublen = attr->l - 4;
+ subattrs = attr->v + 4;
if (!attrvalidate(subattrs, sublen) ||
!msmppe(subattrs, sublen, RAD_VS_ATTR_MS_MPPE_Send_Key, "MS MPPE Send Key",
- rq, server->conf->secret, from->conf->secret) ||
+ rqout, server->conf->secret, from->conf->secret) ||
!msmppe(subattrs, sublen, RAD_VS_ATTR_MS_MPPE_Recv_Key, "MS MPPE Recv Key",
- rq, server->conf->secret, from->conf->secret))
+ rqout, server->conf->secret, from->conf->secret))
break;
}
- if (attr) {
- pthread_mutex_unlock(&server->newrq_mutex);
+ if (node) {
debug(DBG_WARN, "replyh: MS attribute handling failed, ignoring reply");
- return 0;
+ goto errunlock;
}
-
- if (*buf == RAD_Access_Accept || *buf == RAD_Access_Reject || *buf == RAD_Accounting_Response) {
- attr = attrget(rq->buf + 20, RADLEN(rq->buf) - 20, RAD_Attr_User_Name);
- if (attr) {
- radattr2ascii(tmp, sizeof(tmp), attr);
- attr = attrget(rq->buf + 20, RADLEN(rq->buf) - 20, RAD_Attr_Calling_Station_Id);
- if (attr) {
- radattr2ascii(stationid, sizeof(stationid), attr);
+
+ if (msg->code == RAD_Access_Accept || msg->code == RAD_Access_Reject || msg->code == RAD_Accounting_Response) {
+ username = radattr2ascii(radmsg_gettype(rqout->msg, RAD_Attr_User_Name));
+ if (username) {
+ stationid = radattr2ascii(radmsg_gettype(rqout->msg, RAD_Attr_Calling_Station_Id));
+ if (stationid) {
debug(DBG_INFO, "%s for user %s stationid %s from %s",
- radmsgtype2string(*buf), tmp, stationid, server->conf->host);
+ radmsgtype2string(msg->code), username, stationid, server->conf->host);
+ free(stationid);
} else
- debug(DBG_INFO, "%s for user %s from %s", radmsgtype2string(*buf), tmp, server->conf->host);
+ debug(DBG_INFO, "%s for user %s from %s", radmsgtype2string(msg->code), username, server->conf->host);
+ free(username);
}
}
-
- buf[1] = (char)rq->origid;
- memcpy(buf + 4, rq->origauth, 16);
+
+ msg->id = (char)rqout->origid;
+ memcpy(msg->auth, rqout->origauth, 16);
+
#ifdef DEBUG
printfchars(NULL, "origauth/buf+4", "%02x ", buf + 4, 16);
#endif
- if (rq->origusername && (attr = attrget(buf + 20, RADLEN(buf) - 20, RAD_Attr_User_Name))) {
- username = resizeattr(&buf, &attr, strlen(rq->origusername));
- if (!username) {
- pthread_mutex_unlock(&server->newrq_mutex);
+ if (rqout->origusername && (attr = radmsg_gettype(msg, RAD_Attr_User_Name))) {
+ if (!resizeattr(attr, strlen(rqout->origusername))) {
debug(DBG_WARN, "replyh: malloc failed, ignoring reply");
- return 0;
+ goto errunlock;
}
- memcpy(username, rq->origusername, strlen(rq->origusername));
- len = RADLEN(buf) - 20;
- attrs = buf + 20;
- if (messageauth)
- messageauth = attrget(attrs, len, RAD_Attr_Message_Authenticator);
- }
-
- if (from->conf->rewriteout) {
- if (!dorewrite(&buf, from->conf->rewriteout))
- return 0;
- len = RADLEN(buf) - 20;
- attrs = buf + 20;
- if (messageauth)
- messageauth = attrget(attrs, len, RAD_Attr_Message_Authenticator);
+ memcpy(attr->v, rqout->origusername, strlen(rqout->origusername));
}
-
- if (messageauth) {
- if (!createmessageauth(buf, ATTRVAL(messageauth), from->conf->secret)) {
- pthread_mutex_unlock(&server->newrq_mutex);
- debug(DBG_WARN, "replyh: failed to create authenticator, malloc failed?, ignoring reply");
- return 0;
- }
- debug(DBG_DBG, "replyh: computed messageauthattr");
+
+ if (from->conf->rewriteout && !dorewrite(msg, from->conf->rewriteout)) {
+ debug(DBG_WARN, "replyh: rewriteout failed");
+ goto errunlock;
}
- fromsa = rq->fromsa; /* only needed for UDP */
+ fromsa = rqout->rq->fromsa; /* only needed for UDP */
/* once we set received = 1, rq may be reused */
- rq->received = 1;
+ rqout->received = 1;
debug(DBG_INFO, "replyh: passing reply to client %s", from->conf->name);
- sendreply(from, buf, &fromsa, rq->fromudpsock);
+ sendreply(from, msg, &fromsa, rqout->rq->fromudpsock);
pthread_mutex_unlock(&server->newrq_mutex);
- return 1;
+ return;
+
+ errunlock:
+ radmsg_free(msg);
+ pthread_mutex_unlock(&server->newrq_mutex);
+ return;
+}
+
+struct radmsg *createstatsrvmsg() {
+ struct radmsg *msg;
+ struct tlv *attr;
+
+ msg = radmsg_init(RAD_Status_Server, 0, NULL);
+ if (!msg)
+ return NULL;
+
+ attr = maketlv(RAD_Attr_Message_Authenticator, 16, NULL);
+ if (!attr) {
+ radmsg_free(msg);
+ return NULL;
+ }
+ if (!radmsg_add(msg, attr)) {
+ freetlv(attr);
+ radmsg_free(msg);
+ return NULL;
+ }
+ return msg;
}
/* code for removing state not finished */
void *clientwr(void *arg) {
struct server *server = (struct server *)arg;
- struct request *rq;
+ struct rqout *rqout;
pthread_t clientrdth;
int i, secs, dynconffail = 0;
uint8_t rnd;
struct timeval now, laststatsrv;
struct timespec timeout;
- struct request statsrvrq;
- unsigned char statsrvbuf[38];
+ struct rqout statsrvrq;
struct clsrvconf *conf;
conf = server->conf;
memset(&timeout, 0, sizeof(struct timespec));
if (conf->statusserver) {
- memset(&statsrvrq, 0, sizeof(struct request));
- memset(statsrvbuf, 0, sizeof(statsrvbuf));
- statsrvbuf[0] = RAD_Status_Server;
- statsrvbuf[3] = 38;
- statsrvbuf[20] = RAD_Attr_Message_Authenticator;
- statsrvbuf[21] = 18;
gettimeofday(&server->lastrcv, NULL);
gettimeofday(&laststatsrv, NULL);
}
pthread_mutex_unlock(&server->newrq_mutex);
break;
}
- rq = server->requests + i;
+ rqout = server->requests + i;
- if (rq->received) {
+ if (rqout->received) {
debug(DBG_DBG, "clientwr: packet %d in queue is marked as received", i);
- if (rq->buf) {
+ if (rqout->buf) {
debug(DBG_DBG, "clientwr: freeing received packet %d from queue", i);
- freerqdata(rq);
+ freerqoutdata(rqout);
/* setting this to NULL means that it can be reused */
- rq->buf = NULL;
+ rqout->buf = NULL;
}
pthread_mutex_unlock(&server->newrq_mutex);
continue;
}
gettimeofday(&now, NULL);
- if (now.tv_sec < rq->expiry.tv_sec) {
- if (!timeout.tv_sec || rq->expiry.tv_sec < timeout.tv_sec)
- timeout.tv_sec = rq->expiry.tv_sec;
+ if (now.tv_sec < rqout->expiry.tv_sec) {
+ if (!timeout.tv_sec || rqout->expiry.tv_sec < timeout.tv_sec)
+ timeout.tv_sec = rqout->expiry.tv_sec;
pthread_mutex_unlock(&server->newrq_mutex);
continue;
}
- if (rq->tries == (*rq->buf == RAD_Status_Server ? 1 : conf->retrycount + 1)) {
+ if (rqout->tries == (*rqout->buf == RAD_Status_Server ? 1 : conf->retrycount + 1)) {
debug(DBG_DBG, "clientwr: removing expired packet from queue");
if (conf->statusserver) {
- if (*rq->buf == RAD_Status_Server) {
+ if (*rqout->buf == RAD_Status_Server) {
debug(DBG_WARN, "clientwr: no status server response, %s dead?", conf->host);
if (server->lostrqs < 255)
server->lostrqs++;
if (server->lostrqs < 255)
server->lostrqs++;
}
- freerqdata(rq);
+ freerqoutdata(rqout);
/* setting this to NULL means that it can be reused */
- rq->buf = NULL;
+ rqout->buf = NULL;
pthread_mutex_unlock(&server->newrq_mutex);
continue;
}
pthread_mutex_unlock(&server->newrq_mutex);
- rq->expiry.tv_sec = now.tv_sec + conf->retryinterval;
- if (!timeout.tv_sec || rq->expiry.tv_sec < timeout.tv_sec)
- timeout.tv_sec = rq->expiry.tv_sec;
- rq->tries++;
+ rqout->expiry.tv_sec = now.tv_sec + conf->retryinterval;
+ if (!timeout.tv_sec || rqout->expiry.tv_sec < timeout.tv_sec)
+ timeout.tv_sec = rqout->expiry.tv_sec;
+ rqout->tries++;
conf->pdef->clientradput(server, server->requests[i].buf);
}
if (conf->statusserver) {
gettimeofday(&now, NULL);
if (now.tv_sec - secs > STATUS_SERVER_PERIOD) {
laststatsrv = now;
- if (!RAND_bytes(statsrvbuf + 4, 16)) {
- debug(DBG_WARN, "clientwr: failed to generate random auth");
- continue;
+ memset(&statsrvrq, 0, sizeof(struct rqout));
+ statsrvrq.msg = createstatsrvmsg();
+ if (statsrvrq.msg) {
+ debug(DBG_DBG, "clientwr: sending status server to %s", conf->host);
+ sendrq(server, &statsrvrq);
}
- statsrvrq.buf = malloc(sizeof(statsrvbuf));
- if (!statsrvrq.buf) {
- debug(DBG_ERR, "clientwr: malloc failed");
- continue;
- }
- memcpy(statsrvrq.buf, statsrvbuf, sizeof(statsrvbuf));
- debug(DBG_DBG, "clientwr: sending status server to %s", conf->host);
- sendrq(server, &statsrvrq);
}
}
}
}
/* should accept both names and numeric values, only numeric right now */
-struct attribute *extractattr(char *nameval) {
+struct tlv *extractattr(char *nameval) {
int len, name = 0;
char *s;
- struct attribute *a;
+ struct tlv *a;
s = strchr(nameval, ':');
name = atoi(nameval);
len = strlen(s + 1);
if (len > 253)
return NULL;
- a = malloc(sizeof(struct attribute));
+ a = malloc(sizeof(struct tlv));
if (!a)
return NULL;
a->v = (uint8_t *)stringcopy(s + 1, 0);
uint8_t *rma = NULL;
uint32_t *p, *rmva = NULL;
struct list *adda = NULL, *moda = NULL;
- struct attribute *a;
+ struct tlv *a;
struct modattr *m;
if (rmattrs) {
free(conf->rewriteout);
if (conf->addrinfo)
freeaddrinfo(conf->addrinfo);
+ if (conf->lock) {
+ pthread_mutex_destroy(conf->lock);
+ free(conf->lock);
+ }
/* not touching ssl_ctx, clients and servers */
free(conf);
}
int confclient_cb(struct gconffile **cf, void *arg, char *block, char *opt, char *val) {
struct clsrvconf *conf;
char *conftype = NULL, *rewriteinalias = NULL;
+ long int dupinterval = LONG_MIN;
debug(DBG_DBG, "confclient_cb called for %s", block);
conf = malloc(sizeof(struct clsrvconf));
- if (!conf || !list_push(clconfs, conf))
+ if (!conf)
debugx(1, DBG_ERR, "malloc failed");
memset(conf, 0, sizeof(struct clsrvconf));
conf->certnamecheck = 1;
"tls", CONF_STR, &conf->tls,
"matchcertificateattribute", CONF_STR, &conf->matchcertattr,
"CertificateNameCheck", CONF_BLN, &conf->certnamecheck,
+ "DuplicateInterval", CONF_LINT, &dupinterval,
"rewrite", CONF_STR, &rewriteinalias,
"rewriteIn", CONF_STR, &conf->confrewritein,
"rewriteOut", CONF_STR, &conf->confrewriteout,
if (conf->matchcertattr && !addmatchcertattr(conf))
debugx(1, DBG_ERR, "error in block %s, invalid MatchCertificateAttributeValue", block);
}
-
+
+ if (dupinterval != LONG_MIN) {
+ if (dupinterval < 0 || dupinterval > 255)
+ debugx(1, DBG_ERR, "error in block %s, value of option DuplicateInterval is %d, must be 0-255", block, dupinterval);
+ conf->dupinterval = (uint8_t)dupinterval;
+ } else
+ conf->dupinterval = conf->pdef->duplicateintervaldefault;
+
if (!conf->confrewritein)
conf->confrewritein = rewriteinalias;
else
if (!conf->secret)
debugx(1, DBG_ERR, "malloc failed");
}
+
+ conf->lock = malloc(sizeof(pthread_mutex_t));
+ if (!conf->lock)
+ debugx(1, DBG_ERR, "malloc failed");
+
+ pthread_mutex_init(conf->lock, NULL);
+ if (!list_push(clconfs, conf))
+ debugx(1, DBG_ERR, "malloc failed");
return 1;
}