X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=dtls.c;h=d99c55de585299adc2a4c696551d4cf900a36fc4;hb=e6b234bb547479f8862badeee58d1b1415a2439d;hp=a80c8fd8957c396a2fc6d449586c0c776b217409;hpb=52570225d77be0f9c751ab30e8ec6f98639be827;p=radsecproxy.git

diff --git a/dtls.c b/dtls.c
index a80c8fd..d99c55d 100644
--- a/dtls.c
+++ b/dtls.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Stig Venaas <venaas@uninett.no>
+ * Copyright (C) 2008-2009 Stig Venaas <venaas@uninett.no>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -26,35 +26,90 @@
 #include <pthread.h>
 #include <openssl/ssl.h>
 #include <openssl/err.h>
-#include "debug.h"
 #include "list.h"
 #include "hash.h"
-#include "util.h"
 #include "radsecproxy.h"
-#include "dtls.h"
+
+#ifdef RADPROT_DTLS
+#include "debug.h"
+#include "util.h"
+#include "hostport.h"
+
+static void setprotoopts(struct commonprotoopts *opts);
+static char **getlistenerargs();
+void *udpdtlsserverrd(void *arg);
+int dtlsconnect(struct server *server, struct timeval *when, int timeout, char *text);
+void *dtlsclientrd(void *arg);
+int clientradputdtls(struct server *server, unsigned char *rad);
+void addserverextradtls(struct clsrvconf *conf);
+void dtlssetsrcres();
+void initextradtls();
+
+static const struct protodefs protodefs = {
+    "dtls",
+    "mysecret", /* secretdefault */
+    SOCK_DGRAM, /* socktype */
+    "2083", /* portdefault */
+    REQUEST_RETRY_COUNT, /* retrycountdefault */
+    10, /* retrycountmax */
+    REQUEST_RETRY_INTERVAL, /* retryintervaldefault */
+    60, /* retryintervalmax */
+    DUPLICATE_INTERVAL, /* duplicateintervaldefault */
+    setprotoopts, /* setprotoopts */
+    getlistenerargs, /* getlistenerargs */
+    udpdtlsserverrd, /* listener */
+    dtlsconnect, /* connecter */
+    dtlsclientrd, /* clientconnreader */
+    clientradputdtls, /* clientradput */
+    NULL, /* addclient */
+    addserverextradtls, /* addserverextra */
+    dtlssetsrcres, /* setsrcres */
+    initextradtls /* initextra */
+};
 
 static int client4_sock = -1;
 static int client6_sock = -1;
+static struct addrinfo *srcres = NULL;
+static uint8_t handle;
+static struct commonprotoopts *protoopts = NULL;
+
+const struct protodefs *dtlsinit(uint8_t h) {
+    handle = h;
+    return &protodefs;
+}
+
+static void setprotoopts(struct commonprotoopts *opts) {
+    protoopts = opts;
+}
+
+static char **getlistenerargs() {
+    return protoopts ? protoopts->listenargs : NULL;
+}
 
 struct sessioncacheentry {
     pthread_mutex_t mutex;
-    struct queue *rbios;
+    struct gqueue *rbios;
     struct timeval expiry;
 };
 
 struct dtlsservernewparams {
     struct sessioncacheentry *sesscache;
     int sock;
-    struct sockaddr_storage addr;    
+    struct sockaddr_storage addr;
 };
 
-int udp2bio(int s, struct queue *q, int cnt) {
+void dtlssetsrcres() {
+    if (!srcres)
+	srcres = resolvepassiveaddrinfo(protoopts ? protoopts->sourcearg : NULL, NULL, protodefs.socktype);
+}
+
+int udp2bio(int s, struct gqueue *q, int cnt) {
     unsigned char *buf;
     BIO *rbio;
 
     if (cnt < 1)
 	return 0;
-    
+
     buf = malloc(cnt);
     if (!buf) {
 	unsigned char err;
@@ -84,7 +139,7 @@ int udp2bio(int s, struct queue *q, int cnt) {
     return 1;
 }
 
-BIO *getrbio(SSL *ssl, struct queue *q, int timeout) {
+BIO *getrbio(SSL *ssl, struct gqueue *q, int timeout) {
     BIO *rbio;
     struct timeval now;
     struct timespec to;
@@ -104,10 +159,10 @@ BIO *getrbio(SSL *ssl, struct queue *q, int timeout) {
     return rbio;
 }
 
-int dtlsread(SSL *ssl, struct queue *q, unsigned char *buf, int num, int timeout) {
+int dtlsread(SSL *ssl, struct gqueue *q, unsigned char *buf, int num, int timeout) {
     int len, cnt;
     BIO *rbio;
-    
+
     for (len = 0; len < num; len += cnt) {
 	cnt = SSL_read(ssl, buf + len, num - len);
 	if (cnt <= 0)
@@ -116,7 +171,7 @@ int dtlsread(SSL *ssl, struct queue *q, unsigned char *buf, int num, int timeout
 		rbio = getrbio(ssl, q, timeout);
 		if (!rbio)
 		    return 0;
-		BIO_free(ssl->rbio);		
+		BIO_free(ssl->rbio);
 		ssl->rbio = rbio;
 		cnt = 0;
 		continue;
@@ -135,7 +190,7 @@ int dtlsread(SSL *ssl, struct queue *q, unsigned char *buf, int num, int timeout
 }
 
 /* accept if acc == 1, else connect */
-SSL *dtlsacccon(uint8_t acc, SSL_CTX *ctx, int s, struct sockaddr *addr, struct queue *rbios) {
+SSL *dtlsacccon(uint8_t acc, SSL_CTX *ctx, int s, struct sockaddr *addr, struct gqueue *rbios) {
     SSL *ssl;
     int i, res;
     unsigned long error;
@@ -144,11 +199,11 @@ SSL *dtlsacccon(uint8_t acc, SSL_CTX *ctx, int s, struct sockaddr *addr, struct
     ssl = SSL_new(ctx);
     if (!ssl)
 	return NULL;
-    
+
     mem0bio = BIO_new(BIO_s_mem());
     BIO_set_mem_eof_return(mem0bio, -1);
     wbio = BIO_new_dgram(s, BIO_NOCLOSE);
-    BIO_dgram_set_peer(wbio, addr);
+    i = BIO_dgram_set_peer(wbio, addr); /* i just to avoid warning */
     SSL_set_bio(ssl, mem0bio, wbio);
 
     for (i = 0; i < 5; i++) {
@@ -171,7 +226,7 @@ SSL *dtlsacccon(uint8_t acc, SSL_CTX *ctx, int s, struct sockaddr *addr, struct
     return NULL;
 }
 
-unsigned char *raddtlsget(SSL *ssl, struct queue *rbios, int timeout) {
+unsigned char *raddtlsget(SSL *ssl, struct gqueue *rbios, int timeout) {
     int cnt, len;
     unsigned char buf[4], *rad;
 
@@ -189,21 +244,21 @@ unsigned char *raddtlsget(SSL *ssl, struct queue *rbios, int timeout) {
 	    continue;
 	}
 	memcpy(rad, buf, 4);
-	
+
 	cnt = dtlsread(ssl, rbios, rad + 4, len - 4, timeout);
         if (cnt < 1) {
             debug(DBG_DBG, cnt ? "raddtlsget: connection lost" : "raddtlsget: timeout");
             free(rad);
             return NULL;
         }
-        
+
         if (len >= 20)
             break;
-	
+
         free(rad);
         debug(DBG_WARN, "raddtlsget: packet smaller than minimum radius size");
     }
-    
+
     debug(DBG_DBG, "raddtlsget: got %d bytes", len);
     return rad;
 }
@@ -212,15 +267,15 @@ void *dtlsserverwr(void *arg) {
     int cnt;
     unsigned long error;
     struct client *client = (struct client *)arg;
-    struct queue *replyq;
-    struct reply *reply;
-    
-    debug(DBG_DBG, "dtlsserverwr: starting for %s", client->conf->host);
+    struct gqueue *replyq;
+    struct request *reply;
+
+    debug(DBG_DBG, "dtlsserverwr: starting for %s", addr2string(client->addr));
     replyq = client->replyq;
     for (;;) {
 	pthread_mutex_lock(&replyq->mutex);
 	while (!list_first(replyq->entries)) {
-	    if (client->ssl) {	    
+	    if (client->ssl) {
 		debug(DBG_DBG, "dtlsserverwr: waiting for signal");
 		pthread_cond_wait(&replyq->cond, &replyq->mutex);
 		debug(DBG_DBG, "dtlsserverwr: got signal");
@@ -233,25 +288,25 @@ void *dtlsserverwr(void *arg) {
 		pthread_exit(NULL);
 	    }
 	}
-	reply = (struct reply *)list_shift(replyq->entries);
+	reply = (struct request *)list_shift(replyq->entries);
 	pthread_mutex_unlock(&replyq->mutex);
-	cnt = SSL_write(client->ssl, reply->buf, RADLEN(reply->buf));
+	cnt = SSL_write(client->ssl, reply->replybuf, RADLEN(reply->replybuf));
 	if (cnt > 0)
-	    debug(DBG_DBG, "dtlsserverwr: sent %d bytes, Radius packet of length %d",
-		  cnt, RADLEN(reply->buf));
+	    debug(DBG_DBG, "dtlsserverwr: sent %d bytes, Radius packet of length %d to %s",
+		  cnt, RADLEN(reply->replybuf), addr2string(client->addr));
 	else
 	    while ((error = ERR_get_error()))
 		debug(DBG_ERR, "dtlsserverwr: SSL: %s", ERR_error_string(error, NULL));
-	free(reply->buf);
-	free(reply);
+	freerq(reply);
     }
 }
 
 void dtlsserverrd(struct client *client) {
-    struct request rq;
+    struct request *rq;
+    uint8_t *buf;
     pthread_t dtlsserverwrth;
-    
-    debug(DBG_DBG, "dtlsserverrd: starting for %s", client->conf->host);
+
+    debug(DBG_DBG, "dtlsserverrd: starting for %s", addr2string(client->addr));
 
     if (pthread_create(&dtlsserverwrth, NULL, dtlsserverwr, (void *)client)) {
 	debug(DBG_ERR, "dtlsserverrd: pthread_create failed");
@@ -259,20 +314,25 @@ void dtlsserverrd(struct client *client) {
     }
 
     for (;;) {
-	memset(&rq, 0, sizeof(struct request));
-	rq.buf = raddtlsget(client->ssl, client->rbios, IDLE_TIMEOUT);
-	if (!rq.buf) {
-	    debug(DBG_ERR, "dtlsserverrd: connection from %s lost", client->conf->host);
+	buf = raddtlsget(client->ssl, client->rbios, IDLE_TIMEOUT);
+	if (!buf) {
+	    debug(DBG_ERR, "dtlsserverrd: connection from %s lost", addr2string(client->addr));
 	    break;
 	}
-	debug(DBG_DBG, "dtlsserverrd: got Radius message from %s", client->conf->host);
-	rq.from = client;
-	if (!radsrv(&rq)) {
-	    debug(DBG_ERR, "dtlsserverrd: message authentication/validation failed, closing connection from %s", client->conf->host);
+	debug(DBG_DBG, "dtlsserverrd: got Radius message from %s", addr2string(client->addr));
+	rq = newrequest();
+	if (!rq) {
+	    free(buf);
+	    continue;
+	}
+	rq->buf = buf;
+	rq->from = client;
+	if (!radsrv(rq)) {
+	    debug(DBG_ERR, "dtlsserverrd: message authentication/validation failed, closing connection from %s", addr2string(client->addr));
 	    break;
 	}
     }
-    
+
     /* stop writer by setting ssl to NULL and give signal in case waiting for data */
     client->ssl = NULL;
 
@@ -281,8 +341,7 @@ void dtlsserverrd(struct client *client) {
     pthread_mutex_unlock(&client->replyq->mutex);
     debug(DBG_DBG, "dtlsserverrd: waiting for writer to end");
     pthread_join(dtlsserverwrth, NULL);
-    removeclientrqs(client);
-    debug(DBG_DBG, "dtlsserverrd: reader for %s exiting", client->conf->host);
+    debug(DBG_DBG, "dtlsserverrd: reader for %s exiting", addr2string(client->addr));
 }
 
 void *dtlsservernew(void *arg) {
@@ -292,12 +351,16 @@ void *dtlsservernew(void *arg) {
     struct list_node *cur = NULL;
     SSL *ssl = NULL;
     X509 *cert = NULL;
+    SSL_CTX *ctx = NULL;
     uint8_t delay = 60;
 
     debug(DBG_DBG, "dtlsservernew: starting");
-    conf = find_clconf(RAD_DTLS, (struct sockaddr *)&params->addr, NULL);
+    conf = find_clconf(handle, (struct sockaddr *)&params->addr, NULL);
     if (conf) {
-	ssl = dtlsacccon(1, conf->ssl_ctx, params->sock, (struct sockaddr *)&params->addr, params->sesscache->rbios);
+	ctx = tlsgetctx(handle, conf->tlsconf);
+	if (!ctx)
+	    goto exit;
+	ssl = dtlsacccon(1, ctx, params->sock, (struct sockaddr *)&params->addr, params->sesscache->rbios);
 	if (!ssl)
 	    goto exit;
 	cert = verifytlscert(ssl);
@@ -308,9 +371,10 @@ void *dtlsservernew(void *arg) {
     while (conf) {
 	if (verifyconfcert(cert, conf)) {
 	    X509_free(cert);
-	    client = addclient(conf);
+	    client = addclient(conf, 1);
 	    if (client) {
 		client->sock = params->sock;
+		client->addr = addr_copy((struct sockaddr *)&params->addr);
 		client->rbios = params->sesscache->rbios;
 		client->ssl = ssl;
 		dtlsserverrd(client);
@@ -321,14 +385,14 @@ void *dtlsservernew(void *arg) {
 	    }
 	    goto exit;
 	}
-	conf = find_clconf(RAD_DTLS, (struct sockaddr *)&params->addr, &cur);
+	conf = find_clconf(handle, (struct sockaddr *)&params->addr, &cur);
     }
     debug(DBG_WARN, "dtlsservernew: ignoring request, no matching TLS client");
 
     if (cert)
 	X509_free(cert);
 
- exit:
+exit:
     if (ssl) {
 	SSL_shutdown(ssl);
 	SSL_free(ssl);
@@ -349,7 +413,7 @@ void cacheexpire(struct hash *cache, struct timeval *last) {
     struct timeval now;
     struct hash_entry *he;
     struct sessioncacheentry *e;
-    
+
     gettimeofday(&now, NULL);
     if (now.tv_sec - last->tv_sec < 19)
 	return;
@@ -384,12 +448,12 @@ void *udpdtlsserverrd(void *arg) {
     pthread_t dtlsserverth;
     struct hash *sessioncache;
     struct sessioncacheentry *cacheentry;
-    
+
     sessioncache = hash_create();
     if (!sessioncache)
 	debugx(1, DBG_ERR, "udpdtlsserverrd: malloc failed");
     gettimeofday(&lastexpiry, NULL);
-    
+
     for (;;) {
 	FD_ZERO(&readfds);
         FD_SET(s, &readfds);
@@ -412,7 +476,7 @@ void *udpdtlsserverrd(void *arg) {
 	    pthread_mutex_lock(&cacheentry->mutex);
 	    if (cacheentry->rbios) {
 		if (udp2bio(s, cacheentry->rbios, cnt))
-		    debug(DBG_DBG, "udpdtlsserverrd: got DTLS in UDP from %s", addr2string((struct sockaddr *)&from, fromlen));
+		    debug(DBG_DBG, "udpdtlsserverrd: got DTLS in UDP from %s", addr2string((struct sockaddr *)&from));
 	    } else
 		recv(s, buf, 1, 0);
 	    pthread_mutex_unlock(&cacheentry->mutex);
@@ -444,7 +508,7 @@ void *udpdtlsserverrd(void *arg) {
 	    memcpy(&params->addr, &from, fromlen);
 
 	    if (udp2bio(s, params->sesscache->rbios, cnt)) {
-		debug(DBG_DBG, "udpdtlsserverrd: got DTLS in UDP from %s", addr2string((struct sockaddr *)&from, fromlen));
+		debug(DBG_DBG, "udpdtlsserverrd: got DTLS in UDP from %s", addr2string((struct sockaddr *)&from));
 		if (!pthread_create(&dtlsserverth, NULL, dtlsservernew, (void *)params)) {
 		    pthread_detach(dtlsserverth);
 		    cacheexpire(sessioncache, &lastexpiry);
@@ -466,7 +530,9 @@ int dtlsconnect(struct server *server, struct timeval *when, int timeout, char *
     struct timeval now;
     time_t elapsed;
     X509 *cert;
-    
+    SSL_CTX *ctx = NULL;
+    struct hostportres *hp;
+
     debug(DBG_DBG, "dtlsconnect: called from %s", text);
     pthread_mutex_lock(&server->lock);
     if (when && memcmp(&server->lastconnecttry, when, sizeof(struct timeval))) {
@@ -476,6 +542,7 @@ int dtlsconnect(struct server *server, struct timeval *when, int timeout, char *
 	return 1;
     }
 
+    hp = (struct hostportres *)list_first(server->conf->hostports)->data;
     for (;;) {
 	gettimeofday(&now, NULL);
 	elapsed = now.tv_sec - server->lastconnecttry.tv_sec;
@@ -501,24 +568,29 @@ int dtlsconnect(struct server *server, struct timeval *when, int timeout, char *
 	    sleep(60);
 	} else
 	    server->lastconnecttry.tv_sec = now.tv_sec;  /* no sleep at startup */
-	debug(DBG_WARN, "dtlsconnect: trying to open DTLS connection to %s port %s", server->conf->host, server->conf->port);
+	debug(DBG_WARN, "dtlsconnect: trying to open DTLS connection to %s port %s", hp->host, hp->port);
 
 	SSL_free(server->ssl);
-	server->ssl = dtlsacccon(0, server->conf->ssl_ctx, server->sock, server->conf->addrinfo->ai_addr, server->rbios);
+	server->ssl = NULL;
+	ctx = tlsgetctx(handle, server->conf->tlsconf);
+	if (!ctx)
+	    continue;
+	server->ssl = dtlsacccon(0, ctx, server->sock, hp->addrinfo->ai_addr, server->rbios);
 	if (!server->ssl)
 	    continue;
 	debug(DBG_DBG, "dtlsconnect: DTLS: ok");
-	
+
 	cert = verifytlscert(server->ssl);
 	if (!cert)
 	    continue;
-	
+
 	if (verifyconfcert(cert, server->conf))
 	    break;
 	X509_free(cert);
     }
     X509_free(cert);
-    debug(DBG_WARN, "dtlsconnect: DTLS connection to %s port %s up", server->conf->host, server->conf->port);
+    debug(DBG_WARN, "dtlsconnect: DTLS connection to %s port %s up", hp->host, hp->port);
+    server->connectionok = 1;
     gettimeofday(&server->lastconnecttry, NULL);
     pthread_mutex_unlock(&server->lock);
     return 1;
@@ -530,14 +602,15 @@ int clientradputdtls(struct server *server, unsigned char *rad) {
     unsigned long error;
     struct clsrvconf *conf = server->conf;
 
-    if (!server->ssl)
+    if (!server->connectionok)
 	return 0;
     len = RADLEN(rad);
-    while ((cnt = SSL_write(server->ssl, rad, len)) <= 0) {
+    if ((cnt = SSL_write(server->ssl, rad, len)) <= 0) {
 	while ((error = ERR_get_error()))
 	    debug(DBG_ERR, "clientradputdtls: DTLS: %s", ERR_error_string(error, NULL));
+	return 0;
     }
-    debug(DBG_DBG, "clientradputdtls: Sent %d bytes, Radius packet of length %d to DTLS peer %s", cnt, len, conf->host);
+    debug(DBG_DBG, "clientradputdtls: Sent %d bytes, Radius packet of length %d to DTLS peer %s", cnt, len, conf->name);
     return 1;
 }
 
@@ -549,7 +622,7 @@ void *udpdtlsclientrd(void *arg) {
     socklen_t fromlen = sizeof(from);
     struct clsrvconf *conf;
     fd_set readfds;
-    
+
     for (;;) {
 	FD_ZERO(&readfds);
         FD_SET(s, &readfds);
@@ -560,15 +633,15 @@ void *udpdtlsclientrd(void *arg) {
 	    debug(DBG_WARN, "udpdtlsclientrd: recv failed");
 	    continue;
 	}
-	
-	conf = find_srvconf(RAD_DTLS, (struct sockaddr *)&from, NULL);
+
+	conf = find_srvconf(handle, (struct sockaddr *)&from, NULL);
 	if (!conf) {
-	    debug(DBG_WARN, "udpdtlsclientrd: got packet from wrong or unknown DTLS peer %s, ignoring", addr2string((struct sockaddr *)&from, fromlen));
+	    debug(DBG_WARN, "udpdtlsclientrd: got packet from wrong or unknown DTLS peer %s, ignoring", addr2string((struct sockaddr *)&from));
 	    recv(s, buf, 4, 0);
 	    continue;
 	}
 	if (udp2bio(s, conf->servers->rbios, cnt))
-	    debug(DBG_DBG, "radudpget: got DTLS in UDP from %s", addr2string((struct sockaddr *)&from, fromlen));
+	    debug(DBG_DBG, "radudpget: got DTLS in UDP from %s", addr2string((struct sockaddr *)&from));
     }
 }
 
@@ -577,7 +650,7 @@ void *dtlsclientrd(void *arg) {
     unsigned char *buf;
     struct timeval lastconnecttry;
     int secs;
-    
+
     for (;;) {
 	/* yes, lastconnecttry is really necessary */
 	lastconnecttry = server->lastconnecttry;
@@ -594,20 +667,20 @@ void *dtlsclientrd(void *arg) {
 }
 
 void addserverextradtls(struct clsrvconf *conf) {
-    switch (conf->addrinfo->ai_family) {
+    switch (((struct hostportres *)list_first(conf->hostports)->data)->addrinfo->ai_family) {
     case AF_INET:
 	if (client4_sock < 0) {
-	    client4_sock = bindtoaddr(getsrcprotores(RAD_DTLS), AF_INET, 0, 1);
+	    client4_sock = bindtoaddr(srcres, AF_INET, 0, 1);
 	    if (client4_sock < 0)
-		debugx(1, DBG_ERR, "addserver: failed to create client socket for server %s", conf->host);
+		debugx(1, DBG_ERR, "addserver: failed to create client socket for server %s", conf->name);
 	}
 	conf->servers->sock = client4_sock;
 	break;
     case AF_INET6:
 	if (client6_sock < 0) {
-	    client6_sock = bindtoaddr(getsrcprotores(RAD_DTLS), AF_INET6, 0, 1);
+	    client6_sock = bindtoaddr(srcres, AF_INET6, 0, 1);
 	    if (client6_sock < 0)
-		debugx(1, DBG_ERR, "addserver: failed to create client socket for server %s", conf->host);
+		debugx(1, DBG_ERR, "addserver: failed to create client socket for server %s", conf->name);
 	}
 	conf->servers->sock = client6_sock;
 	break;
@@ -618,7 +691,12 @@ void addserverextradtls(struct clsrvconf *conf) {
 
 void initextradtls() {
     pthread_t cl4th, cl6th;
-    
+
+    if (srcres) {
+	freeaddrinfo(srcres);
+	srcres = NULL;
+    }
+
     if (client4_sock >= 0)
 	if (pthread_create(&cl4th, NULL, udpdtlsclientrd, (void *)&client4_sock))
 	    debugx(1, DBG_ERR, "pthread_create failed");
@@ -626,3 +704,12 @@ void initextradtls() {
 	if (pthread_create(&cl6th, NULL, udpdtlsclientrd, (void *)&client6_sock))
 	    debugx(1, DBG_ERR, "pthread_create failed");
 }
+#else
+const struct protodefs *dtlsinit(uint8_t h) {
+    return NULL;
+}
+#endif
+
+/* Local Variables: */
+/* c-file-style: "stroustrup" */
+/* End: */