X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=lib%2Fpacket.c;h=63bf370b39f3bb67bce0c2358f2a9e1059239909;hb=79d36d41a578451a37c134981d5698dec3d5a4d3;hp=6b95b73d9d2d38c08ccf5662f51cc7e4e7c50011;hpb=8a676ab2d88022aea68a2a31ac83dfe25d64e175;p=radsecproxy.git diff --git a/lib/packet.c b/lib/packet.c index 6b95b73..63bf370 100644 --- a/lib/packet.c +++ b/lib/packet.c @@ -1,450 +1,293 @@ -/* See the file COPYING for licensing information. */ +/* Copyright 2010, 2011 NORDUnet A/S. All rights reserved. + See LICENSE for licensing information. */ + +#if defined HAVE_CONFIG_H +#include +#endif -#include #include -#include -#include +#include #include #include #include -#if defined DEBUG +#include "conn.h" +#include "debug.h" +#include "packet.h" + +#if defined (DEBUG) #include #include -#include "debug.h" +#include #endif -static int -_packet_create (struct rs_connection *conn, struct rs_packet **pkt_out) +int +packet_verify_response (struct rs_connection *conn, + struct rs_packet *response, + struct rs_packet *request) { - struct rs_packet *p; - RADIUS_PACKET *rpkt; - - *pkt_out = NULL; + int err; - rpkt = rad_alloc (1); - if (!rpkt) - return rs_err_conn_push (conn, RSE_NOMEM, __func__); - rpkt->id = conn->nextid++; + assert (conn); + assert (conn->active_peer); + assert (conn->active_peer->secret); + assert (response); + assert (response->rpkt); + assert (request); + assert (request->rpkt); + + response->rpkt->secret = conn->active_peer->secret; + response->rpkt->sizeof_secret = strlen (conn->active_peer->secret); + + /* Verify header and message authenticator. */ + err = nr_packet_verify (response->rpkt, request->rpkt); + if (err) + { + if (conn->is_connected) + rs_conn_disconnect(conn); + return rs_err_conn_push_fl (conn, -err, __FILE__, __LINE__, + "nr_packet_verify"); + } - p = (struct rs_packet *) malloc (sizeof (struct rs_packet)); - if (!p) + /* Decode and decrypt. */ + err = nr_packet_decode (response->rpkt, request->rpkt); + if (err) { - rad_free (&rpkt); - return rs_err_conn_push (conn, RSE_NOMEM, __func__); + if (conn->is_connected) + rs_conn_disconnect(conn); + return rs_err_conn_push_fl (conn, -err, __FILE__, __LINE__, + "nr_packet_decode"); } - memset (p, 0, sizeof (struct rs_packet)); - p->conn = conn; - p->rpkt = rpkt; - *pkt_out = p; return RSE_OK; } -static int -_do_send (struct rs_packet *pkt) + +/* Badly named function for preparing a RADIUS message and queue it. + FIXME: Rename. */ +int +packet_do_send (struct rs_packet *pkt) { int err; - if (rad_encode (pkt->rpkt, NULL, pkt->conn->active_peer->secret)) - return rs_err_conn_push_fl (pkg->conn, RSE_FR, __FILE__, __LINE__, - "rad_encode: %s", fr_strerror ()); - if (rad_sign (pkt->rpkt, NULL, pkt->conn->active_peer->secret)) - return rs_err_conn_push_fl (pkg->conn, RSE_FR, __FILE__, __LINE__, - "rad_sign: %s", fr_strerror ()); + assert (pkt); + assert (pkt->conn); + assert (pkt->conn->active_peer); + assert (pkt->conn->active_peer->secret); assert (pkt->rpkt); + + pkt->rpkt->secret = pkt->conn->active_peer->secret; + pkt->rpkt->sizeof_secret = strlen (pkt->rpkt->secret); + + /* Encode message. */ + err = nr_packet_encode (pkt->rpkt, NULL); + if (err < 0) + return rs_err_conn_push_fl (pkt->conn, -err, __FILE__, __LINE__, + "nr_packet_encode"); + /* Sign message. */ + err = nr_packet_sign (pkt->rpkt, NULL); + if (err < 0) + return rs_err_conn_push_fl (pkt->conn, -err, __FILE__, __LINE__, + "nr_packet_sign"); #if defined (DEBUG) { char host[80], serv[80]; - getnameinfo (pkt->conn->active_peer->addr->ai_addr, - pkt->conn->active_peer->addr->ai_addrlen, + getnameinfo (pkt->conn->active_peer->addr_cache->ai_addr, + pkt->conn->active_peer->addr_cache->ai_addrlen, host, sizeof(host), serv, sizeof(serv), 0 /* NI_NUMERICHOST|NI_NUMERICSERV*/); - fprintf (stderr, "%s: about to send this to %s:%s:\n", __func__, host, - serv); + rs_debug (("%s: about to send this to %s:%s:\n", __func__, host, serv)); rs_dump_packet (pkt); } #endif - err = bufferevent_write (pkt->conn->bev, pkt->rpkt->data, - pkt->rpkt->data_len); - if (err < 0) - return rs_err_conn_push_fl (pkt->conn, RSE_EVENT, __FILE__, __LINE__, - "bufferevent_write: %s", - evutil_gai_strerror(err)); - return RSE_OK; -} - -static void -_event_cb (struct bufferevent *bev, short events, void *ctx) -{ - struct rs_packet *pkt = (struct rs_packet *)ctx; - struct rs_connection *conn; - struct rs_peer *p; - int err; - - assert (pkt); - assert (pkt->conn); - assert (pkt->conn->active_peer); - conn = pkt->conn; - p = conn->active_peer; - - p->is_connecting = 0; - if (events & BEV_EVENT_CONNECTED) - { - p->is_connected = 1; - if (conn->callbacks.connected_cb) - conn->callbacks.connected_cb (conn->user_data); - -#if defined (DEBUG) - fprintf (stderr, "%s: connected\n", __func__); -#endif - err = _do_send (pkt); - if (err) - return err; - if (conn->callbacks.sent_cb) - conn->callbacks.sent_cb (conn->user_data); - /* Packet will be freed in write callback. */ - } - else if (events & BEV_EVENT_ERROR) - rs_err_conn_push_fl (pkt->conn, RSE_CONNERR, __FILE__, __LINE__, NULL); -} - -static void -_write_cb (struct bufferevent *bev, void *ctx) -{ - struct rs_packet *pkt = (struct rs_packet *) ctx; - - assert (pkt); - assert (pkt->conn); -#if defined (DEBUG) - fprintf (stderr, "%s: packet written, breaking event loop\n", __func__); -#endif - if (event_base_loopbreak (pkt->conn->evb) < 0) - abort (); /* FIXME */ - rs_packet_destroy (pkt); -} -static void -_read_cb (struct bufferevent *bev, void *ctx) -{ - struct rs_packet *pkt = (struct rs_packet *) ctx; - size_t n; - - assert (pkt); - assert (pkt->conn); - if (!pkt->hdr_read_flag) + /* Put message in output buffer. */ + if (pkt->conn->bev) /* TCP. */ { - n = bufferevent_read (pkt->conn->bev, pkt->hdr, RS_HEADER_LEN); - if (n == RS_HEADER_LEN) - { - pkt->hdr_read_flag = 1; - pkt->rpkt->data_len = (pkt->hdr[2] << 8) + pkt->hdr[3]; - if (pkt->rpkt->data_len < 20 /* || len > 4096 */) - abort (); /* FIXME: Read and discard packet. */ - pkt->rpkt->data = rs_malloc (pkt->conn->ctx, pkt->rpkt->data_len); - if (!pkt->rpkt->data) - { - rs_err_conn_push_fl (pkt->conn, RSE_NOMEM, __FILE__, __LINE__, - NULL); - abort (); /* FIXME: Read and discard packet. */ - } - memcpy (pkt->rpkt->data, pkt->hdr, RS_HEADER_LEN); - bufferevent_setwatermark (pkt->conn->bev, EV_READ, - pkt->rpkt->data_len - RS_HEADER_LEN, 0); -#if defined (DEBUG) - fprintf (stderr, "%s: packet header read, total pkt len=%d\n", - __func__, pkt->rpkt->data_len); -#endif - } - else if (n < 0) - return; /* Buffer frozen. */ - else - assert (!"short header"); + int err = bufferevent_write (pkt->conn->bev, pkt->rpkt->data, + pkt->rpkt->length); + if (err < 0) + return rs_err_conn_push_fl (pkt->conn, RSE_EVENT, __FILE__, __LINE__, + "bufferevent_write: %s", + evutil_gai_strerror (err)); } - -#if defined (DEBUG) - printf ("%s: trying to read %d octets of packet data\n", __func__, pkt->rpkt->data_len - RS_HEADER_LEN); -#endif - n = bufferevent_read (pkt->conn->bev, pkt->rpkt->data + RS_HEADER_LEN, pkt->rpkt->data_len - RS_HEADER_LEN); -#if defined (DEBUG) - printf ("%s: read %d octets of packet data\n", __func__, n); -#endif - if (n == pkt->rpkt->data_len - RS_HEADER_LEN) + else /* UDP. */ { - bufferevent_disable (pkt->conn->bev, EV_READ); - pkt->hdr_read_flag = 0; - memset (pkt->hdr, 0, sizeof(*pkt->hdr)); -#if defined (DEBUG) - fprintf (stderr, "%s: complete packet read\n", __func__); -#endif - if (!rad_packet_ok (pkt->rpkt, 0) != 0) - return; - if (rad_decode (pkt->rpkt, NULL, pkt->conn->active_peer->secret) != 0) - return; - - if (pkt->conn->callbacks.received_cb) - pkt->conn->callbacks.received_cb(pkt, pkt->conn->user_data); - - if (event_base_loopbreak (pkt->conn->evb) < 0) - abort (); /* FIXME */ - } - else if (n < 0) - return; /* Buffer frozen. */ - else - assert (!"short packet"); -} - -static void -_evlog_cb (int severity, const char *msg) -{ - const char *sevstr; - switch (severity) - { - case _EVENT_LOG_DEBUG: -#if !defined (DEBUG_LEVENT) - return; -#endif - sevstr = "debug"; - break; - case _EVENT_LOG_MSG: - sevstr = "msg"; - break; - case _EVENT_LOG_WARN: - sevstr = "warn"; - break; - case _EVENT_LOG_ERR: - sevstr = "err"; - break; - default: - sevstr = "???"; - break; - } - fprintf (stderr, "libevent: [%s] %s\n", sevstr, msg); -} + struct rs_packet **pp = &pkt->conn->out_queue; -static int -_init_evb (struct rs_connection *conn) -{ - if (!conn->evb) - { -#if defined (DEBUG) - event_enable_debug_mode (); -#endif - event_set_log_callback (_evlog_cb); - conn->evb = event_base_new (); - if (!conn->evb) - return rs_err_conn_push_fl (conn, RSE_EVENT, __FILE__, __LINE__, - "event_base_new"); + while (*pp && (*pp)->next) + *pp = (*pp)->next; + *pp = pkt; } - return RSE_OK; -} -static int -_init_socket (struct rs_connection *conn, struct rs_peer *p) -{ - if (p->fd != -1) - return RSE_OK; - - assert (p->addr); - p->fd = socket (p->addr->ai_family, p->addr->ai_socktype, - p->addr->ai_protocol); - if (p->fd < 0) - return rs_err_conn_push_fl (conn, RSE_SOME_ERROR, __FILE__, __LINE__, - strerror (errno)); - if (evutil_make_socket_nonblocking (p->fd) < 0) - { - evutil_closesocket (p->fd); - return rs_err_conn_push_fl (conn, RSE_SOME_ERROR, __FILE__, __LINE__, - strerror (errno)); - } return RSE_OK; } -static struct rs_peer * -_pick_peer (struct rs_connection *conn) -{ - if (!conn->active_peer) - conn->active_peer = conn->peers; - return conn->active_peer; -} - -static int -_init_bev (struct rs_connection *conn, struct rs_peer *peer) -{ - if (!conn->bev) - { - conn->bev = bufferevent_socket_new (conn->evb, peer->fd, 0); - if (!conn->bev) - return rs_err_conn_push_fl (conn, RSE_EVENT, __FILE__, __LINE__, - "bufferevent_socket_new"); - } - return RSE_OK; -} - -static void -_do_connect (struct rs_peer *p) +/* Public functions. */ +int +rs_packet_create (struct rs_connection *conn, struct rs_packet **pkt_out) { + struct rs_packet *p; + RADIUS_PACKET *rpkt; int err; - err = bufferevent_socket_connect (p->conn->bev, p->addr->ai_addr, - p->addr->ai_addrlen); - if (err < 0) - rs_err_conn_push_fl (p->conn, RSE_EVENT, __FILE__, __LINE__, - "bufferevent_socket_connect: %s", - evutil_gai_strerror(err)); - else - p->is_connecting = 1; -} - -static int -_conn_open(struct rs_connection *conn, struct rs_packet *pkt) -{ - struct rs_peer *p; - - if (_init_evb (conn)) - return -1; - - p = _pick_peer (conn); - if (!p) - return rs_err_conn_push_fl (conn, RSE_NOPEER, __FILE__, __LINE__, NULL); + *pkt_out = NULL; - if (_init_socket (conn, p)) - return -1; + rpkt = rs_malloc (conn->ctx, sizeof(*rpkt) + RS_MAX_PACKET_LEN); + if (rpkt == NULL) + return rs_err_conn_push (conn, RSE_NOMEM, __func__); - if (_init_bev (conn, p)) - return -1; + err = nr_packet_init (rpkt, NULL, NULL, + PW_ACCESS_REQUEST, + rpkt + 1, RS_MAX_PACKET_LEN); + if (err < 0) + return rs_err_conn_push (conn, -err, __func__); - if (!p->is_connected) - if (!p->is_connecting) - _do_connect (p); + p = (struct rs_packet *) rs_calloc (conn->ctx, 1, sizeof (*p)); + if (p == NULL) + { + rs_free (conn->ctx, rpkt); + return rs_err_conn_push (conn, RSE_NOMEM, __func__); + } + p->conn = conn; + p->rpkt = rpkt; + *pkt_out = p; return RSE_OK; } -static int -_conn_is_open_p (struct rs_connection *conn) -{ - return conn->active_peer && conn->active_peer->is_connected; -} - -/* Public functions. */ int -rs_packet_create_acc_request (struct rs_connection *conn, - struct rs_packet **pkt_out, - const char *user_name, const char *user_pw) +rs_packet_create_authn_request (struct rs_connection *conn, + struct rs_packet **pkt_out, + const char *user_name, const char *user_pw) { struct rs_packet *pkt; - struct rs_attr *attr; + int err; - if (_packet_create (conn, pkt_out)) + if (rs_packet_create (conn, pkt_out)) return -1; + pkt = *pkt_out; - pkt->rpkt->code = PW_AUTHENTICATION_REQUEST; + pkt->rpkt->code = PW_ACCESS_REQUEST; - if (rs_attr_create (conn, &attr, "User-Name", user_name)) - return -1; - rs_packet_add_attr (pkt, attr); + if (user_name) + { + err = rs_packet_add_avp (pkt, PW_USER_NAME, 0, user_name, + strlen (user_name)); + if (err) + return err; + } - if (rs_attr_create (conn, &attr, "User-Password", user_pw)) - return -1; - /* FIXME: need this too? rad_pwencode(user_pw, &pwlen, SECRET, reqauth) */ - rs_packet_add_attr (pkt, attr); + if (user_pw) + { + err = rs_packet_add_avp (pkt, PW_USER_PASSWORD, 0, user_pw, + strlen (user_pw)); + if (err) + return err; + } return RSE_OK; } -int -rs_packet_send (struct rs_packet *pkt, void *user_data) +void +rs_packet_destroy (struct rs_packet *pkt) { - struct rs_connection *conn; - assert (pkt); - conn = pkt->conn; + assert (pkt->conn); + assert (pkt->conn->ctx); - if (_conn_is_open_p (conn)) - _do_send (pkt); - else - if (_conn_open (conn, pkt)) - return -1; + rs_avp_free (&pkt->rpkt->vps); + rs_free (pkt->conn->ctx, pkt->rpkt); + rs_free (pkt->conn->ctx, pkt); +} - assert (conn->evb); - assert (conn->bev); - assert (conn->active_peer); - assert (conn->active_peer->fd >= 0); +int +rs_packet_add_avp (struct rs_packet *pkt, + unsigned int attr, unsigned int vendor, + const void *data, size_t data_len) + +{ + const DICT_ATTR *da; + VALUE_PAIR *vp; + int err; - if (conn->callbacks.connected_cb || conn->callbacks.disconnected_cb - || conn->callbacks.received_cb || conn->callbacks.sent_cb) - ; /* FIXME: install event callbacks, other than below */ - else + assert (pkt); + assert (pkt->conn); + assert (pkt->conn->ctx); + + da = nr_dict_attr_byvalue (attr, vendor); + if (da == NULL) + return rs_err_conn_push (pkt->conn, RSE_ATTR_TYPE_UNKNOWN, + "nr_dict_attr_byvalue"); + vp = rs_malloc (pkt->conn->ctx, sizeof(*vp)); + if (vp == NULL) + return rs_err_conn_push (pkt->conn, RSE_NOMEM, NULL); + if (nr_vp_init (vp, da) == NULL) { - bufferevent_setcb (conn->bev, _read_cb, _write_cb, _event_cb, pkt); - event_base_dispatch (conn->evb); + nr_vp_free (&vp); + return rs_err_conn_push (pkt->conn, RSE_INTERNAL, NULL); } - -#if defined (DEBUG) - fprintf (stderr, "%s: event loop done\n", __func__); - assert (event_base_got_break(conn->evb)); -#endif + err = nr_vp_set_data (vp, data, data_len); + if (err < 0) + { + nr_vp_free (&vp); + return rs_err_conn_push (pkt->conn, -err, "nr_vp_set_data"); + } + nr_vps_append (&pkt->rpkt->vps, vp); return RSE_OK; } +/* TODO: Rename rs_packet_append_avp, indicating that encoding is + being done. */ int -rs_conn_receive_packet (struct rs_connection *conn, struct rs_packet **pkt_out) +rs_packet_append_avp (struct rs_packet *pkt, + unsigned int attr, unsigned int vendor, + const void *data, size_t data_len) { - struct rs_packet *pkt; - - assert (conn); + const DICT_ATTR *da; + int err; - if (_packet_create (conn, pkt_out)) - return -1; - pkt = *pkt_out; - pkt->conn = conn; + assert (pkt); - if (_conn_open (conn, pkt)) - return -1; - assert (conn->evb); - assert (conn->bev); - assert (conn->active_peer); - assert (conn->active_peer->fd >= 0); + da = nr_dict_attr_byvalue (attr, vendor); + if (da == NULL) + return RSE_ATTR_TYPE_UNKNOWN; - bufferevent_setwatermark (conn->bev, EV_READ, RS_HEADER_LEN, 0); - bufferevent_enable (conn->bev, EV_READ); - event_base_dispatch (conn->evb); -#if defined (DEBUG) - fprintf (stderr, "%s: event loop done", __func__); - if (event_base_got_break(conn->evb)) - { - fprintf (stderr, ", got this:\n"); - rs_dump_packet (pkt); - } - else - fprintf (stderr, ", no reply\n"); -#endif + err = nr_packet_attr_append (pkt->rpkt, NULL, da, data, data_len); + if (err < 0) + return rs_err_conn_push (pkt->conn, -err, __func__); return RSE_OK; } void -rs_packet_add_attr(struct rs_packet *pkt, struct rs_attr *attr) +rs_packet_avps (struct rs_packet *pkt, rs_avp ***vps) { - pairadd (&pkt->rpkt->vps, attr->vp); - attr->pkt = pkt; + assert (pkt); + *vps = &pkt->rpkt->vps; } -struct radius_packet * -rs_packet_frpkt(struct rs_packet *pkt) +unsigned int +rs_packet_code (struct rs_packet *pkt) { assert (pkt); - return pkt->rpkt; + return pkt->rpkt->code; } -void -rs_packet_destroy(struct rs_packet *pkt) +rs_const_avp * +rs_packet_find_avp (struct rs_packet *pkt, unsigned int attr, unsigned int vendor) { - if (pkt) - { - rad_free (&pkt->rpkt); - rs_free (pkt->conn->ctx, pkt); - } + assert (pkt); + return rs_avp_find_const (pkt->rpkt->vps, attr, vendor); +} + +int +rs_packet_set_id (struct rs_packet *pkt, int id) +{ + int old = pkt->rpkt->id; + + pkt->rpkt->id = id; + + return old; }