X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=lib%2Fpacket.c;h=bfa82df9085e13acba537a47a7b5c57ff65b089a;hb=4f9a7e63c1d14837ec880b9a63cc6a92a822e7d5;hp=c90511b79451b84095566293686c500668840a63;hpb=b1437bde86daa8826a8eeb1437cca11dda88283e;p=libradsec.git

diff --git a/lib/packet.c b/lib/packet.c
index c90511b..bfa82df 100644
--- a/lib/packet.c
+++ b/lib/packet.c
@@ -1,329 +1,253 @@
-#include <string.h>
+/* Copyright 2010-2013 NORDUnet A/S. All rights reserved.
+   See LICENSE for licensing information.  */
+
+#if defined HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdlib.h>
 #include <assert.h>
-#include <freeradius/libradius.h>
-#include <event2/event.h>
+#include <radius/client.h>
 #include <event2/bufferevent.h>
-#include "libradsec.h"
-#include "libradsec-impl.h"
-#if defined DEBUG
+#include <radsec/radsec.h>
+#include <radsec/radsec-impl.h>
+#include "conn.h"
 #include "debug.h"
+#include "packet.h"
+
+#if defined (DEBUG)
+#include <netdb.h>
+#include <sys/socket.h>
+#include <event2/buffer.h>
 #endif
 
-static int
-_packet_create (struct rs_connection *conn, struct rs_packet **pkt_out)
+int
+packet_verify_response (struct rs_connection *conn,
+			struct rs_packet *response,
+			struct rs_packet *request)
 {
-  struct rs_packet *p;
-  RADIUS_PACKET *rpkt;
+  int err;
 
-  *pkt_out = NULL;
-
-  rpkt = rad_alloc (1);
-  if (!rpkt)
-    return rs_conn_err_push (conn, RSE_NOMEM, __func__);
-  rpkt->id = -1;
+  assert (conn);
+  assert (conn->active_peer);
+  assert (conn->active_peer->secret);
+  assert (response);
+  assert (response->rpkt);
+  assert (request);
+  assert (request->rpkt);
+
+  response->rpkt->secret = conn->active_peer->secret;
+  response->rpkt->sizeof_secret = strlen (conn->active_peer->secret);
+
+  /* Verify header and message authenticator.  */
+  err = nr_packet_verify (response->rpkt, request->rpkt);
+  if (err)
+    {
+      if (conn->is_connected)
+	rs_conn_disconnect(conn);
+      return rs_err_conn_push_fl (conn, -err, __FILE__, __LINE__,
+				  "nr_packet_verify");
+    }
 
-  p = (struct rs_packet *) malloc (sizeof (struct rs_packet));
-  if (!p)
+  /* Decode and decrypt.  */
+  err = nr_packet_decode (response->rpkt, request->rpkt);
+  if (err)
     {
-      rad_free (&rpkt);
-      return rs_conn_err_push (conn, RSE_NOMEM, __func__);
+      if (conn->is_connected)
+	rs_conn_disconnect(conn);
+      return rs_err_conn_push_fl (conn, -err, __FILE__, __LINE__,
+				  "nr_packet_decode");
     }
-  memset (p, 0, sizeof (struct rs_packet));
-  p->conn = conn;
-  p->rpkt = rpkt;
 
-  *pkt_out = p;
   return RSE_OK;
 }
 
-int
-rs_packet_create_acc_request (struct rs_connection *conn,
-			      struct rs_packet **pkt_out,
-			      const char *user_name, const char *user_pw)
-{
-  struct rs_packet *pkt;
-  struct rs_attr *attr;
 
-  if (_packet_create (conn, pkt_out))
-    return -1;
-  pkt = *pkt_out;
-  pkt->rpkt->code = PW_AUTHENTICATION_REQUEST;
-
-  if (rs_attr_create (conn, &attr, "User-Name", user_name))
-    return -1;
-  rs_packet_add_attr (pkt, attr);
-
-  if (rs_attr_create (conn, &attr, "User-Password", user_pw))
-    return -1;
-  /* FIXME: need this too? rad_pwencode(user_pw, &pwlen, SECRET, reqauth) */
-  rs_packet_add_attr (pkt, attr);
-
-  return RSE_OK;
-}
-
-static void
-_event_cb (struct bufferevent *bev, short events, void *ctx)
+/* Badly named function for preparing a RADIUS message and queue it.
+   FIXME: Rename.  */
+int
+packet_do_send (struct rs_packet *pkt)
 {
-  struct rs_packet *pkt = (struct rs_packet *) ctx;
-  struct rs_connection *conn;
-  struct rs_peer *p;
+  int err;
 
   assert (pkt);
   assert (pkt->conn);
   assert (pkt->conn->active_peer);
-  conn = pkt->conn;
-  p = conn->active_peer;
+  assert (pkt->conn->active_peer->secret);
+  assert (pkt->rpkt);
 
-  p->is_connecting = 0;
-  if (events & BEV_EVENT_CONNECTED)
-    {
-      p->is_connected = 1;
-#if defined (DEBUG)
-      fprintf (stderr, "%s: connected\n", __func__);
-#endif
-      rad_encode (pkt->rpkt, NULL, pkt->conn->active_peer->secret);
-      assert (pkt->rpkt);
+  pkt->rpkt->secret = pkt->conn->active_peer->secret;
+  pkt->rpkt->sizeof_secret = strlen (pkt->rpkt->secret);
+
+  /* Encode message.  */
+  err = nr_packet_encode (pkt->rpkt, NULL);
+  if (err < 0)
+    return rs_err_conn_push_fl (pkt->conn, -err, __FILE__, __LINE__,
+				"nr_packet_encode");
+  /* Sign message.  */
+  err = nr_packet_sign (pkt->rpkt, NULL);
+  if (err < 0)
+    return rs_err_conn_push_fl (pkt->conn, -err, __FILE__, __LINE__,
+				"nr_packet_sign");
 #if defined (DEBUG)
-      fprintf (stderr, "%s: about to send this to %s:\n", __func__, "<fixme>");
-      rs_dump_packet (pkt);
+  {
+    char host[80], serv[80];
+
+    getnameinfo (pkt->conn->active_peer->addr_cache->ai_addr,
+		 pkt->conn->active_peer->addr_cache->ai_addrlen,
+		 host, sizeof(host), serv, sizeof(serv),
+		 0 /* NI_NUMERICHOST|NI_NUMERICSERV*/);
+    rs_debug (("%s: about to send this to %s:%s:\n", __func__, host, serv));
+    rs_dump_packet (pkt);
+  }
 #endif
-      if (bufferevent_write(bev, pkt->rpkt->data, pkt->rpkt->data_len))
-	rs_conn_err_push_fl (pkt->conn, RSE_EVENT, __FILE__, __LINE__,
-			     "bufferevent_write");
-      /* Packet will be freed in write callback.  */
+
+  /* Put message in output buffer.  */
+  if (pkt->conn->bev)		/* TCP.  */
+    {
+      int err = bufferevent_write (pkt->conn->bev, pkt->rpkt->data,
+				   pkt->rpkt->length);
+      if (err < 0)
+	return rs_err_conn_push_fl (pkt->conn, RSE_EVENT, __FILE__, __LINE__,
+				    "bufferevent_write: %s",
+				    evutil_gai_strerror (err));
     }
-  else if (events & BEV_EVENT_ERROR)
-    rs_conn_err_push_fl (pkt->conn, RSE_CONNERR, __FILE__, __LINE__, NULL);
-}
+  else				/* UDP.  */
+    {
+      struct rs_packet **pp = &pkt->conn->out_queue;
 
-void
-rs_packet_destroy(struct rs_packet *pkt)
-{
-  rad_free (&pkt->rpkt);
-  rs_free (pkt->conn->ctx, pkt);
+      while (*pp && (*pp)->next)
+	*pp = (*pp)->next;
+      *pp = pkt;
+    }
+
+  return RSE_OK;
 }
 
-static void
-_write_cb (struct bufferevent *bev, void *ctx)
+/* Public functions.  */
+int
+rs_packet_create (struct rs_connection *conn, struct rs_packet **pkt_out)
 {
-  struct rs_packet *pkt = (struct rs_packet *) ctx;
+  struct rs_packet *p;
+  RADIUS_PACKET *rpkt;
+  int err;
 
-  assert (pkt);
-  assert (pkt->conn);
-#if defined (DEBUG)
-  fprintf (stderr, "%s: packet written, breaking event loop\n", __func__);
-#endif
-  if (event_base_loopbreak (pkt->conn->evb) < 0)
-    abort ();			/* FIXME */
-  rs_packet_destroy (pkt);
-}
+  *pkt_out = NULL;
 
-static void
-_read_cb (struct bufferevent *bev, void *ctx)
-{
-  struct rs_packet *pkt = (struct rs_packet *) ctx;
-  size_t n;
+  rpkt = rs_malloc (conn->ctx, sizeof(*rpkt) + RS_MAX_PACKET_LEN);
+  if (rpkt == NULL)
+    return rs_err_conn_push (conn, RSE_NOMEM, __func__);
 
-  assert (pkt);
-  assert (pkt->conn);
-  if (!pkt->hdr_read_flag)
-    {
-      n = bufferevent_read (pkt->conn->bev, pkt->hdr, 4);
-      if (n == 4)
-	{
-	  uint16_t len = (pkt->hdr[2] << 8) + pkt->hdr[3];
-	  uint8_t *buf = rs_malloc (pkt->conn->ctx, len);
-
-	  pkt->hdr_read_flag = 1;
-	  if (!buf)
-	    {
-	      rs_conn_err_push_fl (pkt->conn, RSE_NOMEM, __FILE__,
-				   __LINE__, NULL);
-	      abort ();	/* FIXME: recovering takes reading of packet */
-	    }
-	  pkt->rpkt->data = buf;
-	  pkt->rpkt->data_len = len;
-	  bufferevent_setwatermark (pkt->conn->bev, EV_READ, len - 4, 0);
-#if defined (DEBUG)
-	  fprintf (stderr, "%s: packet header read, pkt len=%d\n", __func__,
-		   len);
-#endif
-	}
-      else if (n < 0)
-	return;	/* Buffer frozen, i suppose.  Let's hope it thaws.  */
-      else
-	{
-	  assert (n < 4);
-	  return;		/* Need more to complete header.  */
-	  }
-    }
+  err = nr_packet_init (rpkt, NULL, NULL,
+		        PW_ACCESS_REQUEST,
+		        rpkt + 1, RS_MAX_PACKET_LEN);
+  if (err < 0)
+    return rs_err_conn_push (conn, -err, __func__);
 
-  printf ("%s: trying to read %d octets of packet data\n", __func__, pkt->rpkt->data_len - 4);
-  n = bufferevent_read (pkt->conn->bev, pkt->rpkt->data, pkt->rpkt->data_len - 4);
-  printf ("%s: read %d octets of packet data\n", __func__, n);
-  if (n == pkt->rpkt->data_len - 4)
+  p = (struct rs_packet *) rs_calloc (conn->ctx, 1, sizeof (*p));
+  if (p == NULL)
     {
-      bufferevent_disable (pkt->conn->bev, EV_READ);
-      pkt->hdr_read_flag = 0;
-      memset (pkt->hdr, 0, sizeof(*pkt->hdr));
-#if defined (DEBUG)
-      fprintf (stderr, "%s: complete packet read\n", __func__);
-#endif
-      if (event_base_loopbreak (pkt->conn->evb) < 0)
-	abort ();		/* FIXME */
+      rs_free (conn->ctx, rpkt);
+      return rs_err_conn_push (conn, RSE_NOMEM, __func__);
     }
-}
+  p->conn = conn;
+  p->rpkt = rpkt;
 
-static int
-_init_evb (struct rs_connection *conn)
-{
-  if (!conn->evb)
-    {
-#if defined (DEBUG)
-      event_enable_debug_mode ();
-#endif
-      conn->evb = event_base_new ();
-      if (!conn->evb)
-	return rs_conn_err_push_fl (conn, RSE_EVENT, __FILE__, __LINE__,
-				    "event_base_new");
-    }
+  *pkt_out = p;
   return RSE_OK;
 }
 
-static int
-_init_socket (struct rs_connection *conn, struct rs_peer *p)
+int
+rs_packet_create_authn_request (struct rs_connection *conn,
+				struct rs_packet **pkt_out,
+				const char *user_name, const char *user_pw)
 {
-  if (p->s < 0)
+  struct rs_packet *pkt;
+  int err;
+
+  if (rs_packet_create (conn, pkt_out))
+    return -1;
+
+  pkt = *pkt_out;
+  pkt->rpkt->code = PW_ACCESS_REQUEST;
+
+  if (user_name)
     {
-      assert (p->addr);
-      p->s = socket (p->addr->ai_family, p->addr->ai_socktype,
-		     p->addr->ai_protocol);
-      if (p->s < 0)
-	return rs_conn_err_push_fl (conn, RSE_SOME_ERROR, __FILE__, __LINE__,
-				    strerror (errno));
+      err = rs_packet_append_avp (pkt, PW_USER_NAME, 0, user_name, 0);
+      if (err)
+	return err;
     }
-  return RSE_OK;
-}
 
-static struct rs_peer *
-_pick_peer (struct rs_connection *conn)
-{
-  if (!conn->active_peer)
-    conn->active_peer = conn->peers;
-  return conn->active_peer;
-}
-
-static int
-_init_bev (struct rs_connection *conn, struct rs_peer *peer)
-{
-  if (!conn->bev)
+  if (user_pw)
     {
-      conn->bev = bufferevent_socket_new (conn->evb, peer->s, 0);
-      if (!conn->bev)
-	return rs_conn_err_push_fl (conn, RSE_EVENT, __FILE__, __LINE__,
-				    "bufferevent_socket_new");
+      err = rs_packet_append_avp (pkt, PW_USER_PASSWORD, 0, user_pw, 0);
+      if (err)
+	return err;
     }
+
   return RSE_OK;
 }
 
-static void
-_do_connect (struct rs_peer *p)
+void
+rs_packet_destroy (struct rs_packet *pkt)
 {
-  if (bufferevent_socket_connect (p->conn->bev, p->addr->ai_addr,
-				  p->addr->ai_addrlen) < 0)
-    rs_conn_err_push_fl (p->conn, RSE_EVENT, __FILE__, __LINE__,
-			   "bufferevent_socket_connect");
-  else
-    p->is_connecting = 1;
+  assert (pkt);
+  assert (pkt->conn);
+  assert (pkt->conn->ctx);
+
+  rs_avp_free (&pkt->rpkt->vps);
+  rs_free (pkt->conn->ctx, pkt->rpkt);
+  rs_free (pkt->conn->ctx, pkt);
 }
 
-static int
-_conn_open(struct rs_connection *conn, struct rs_packet *pkt)
+int
+rs_packet_append_avp (struct rs_packet *pkt,
+                      unsigned int attr, unsigned int vendor,
+                      const void *data, size_t data_len)
 {
-  struct rs_peer *p;
-
-  if (_init_evb (conn))
-    return -1;
+  const DICT_ATTR *da;
+  int err;
 
-  p = _pick_peer (conn);
-  if (!p)
-    return rs_conn_err_push_fl (conn, RSE_NOPEER, __FILE__, __LINE__, NULL);
-
-  if (_init_socket (conn, p))
-    return -1;
+  assert (pkt);
 
-  if (_init_bev (conn, p))
-    return -1;
-  bufferevent_setcb (conn->bev, _read_cb, _write_cb, _event_cb, pkt);
+  da = nr_dict_attr_byvalue (attr, vendor);
+  if (da == NULL)
+    return rs_err_conn_push (pkt->conn, RSE_ATTR_TYPE_UNKNOWN, __func__);
 
-  if (!p->is_connected)
-    if (!p->is_connecting)
-      _do_connect (p);
+  err = nr_packet_attr_append (pkt->rpkt, NULL, da, data, data_len);
+  if (err < 0)
+    return rs_err_conn_push (pkt->conn, -err, __func__);
 
   return RSE_OK;
 }
 
-int
-rs_packet_send (struct rs_connection *conn, struct rs_packet *pkt, void *data)
+void
+rs_packet_avps (struct rs_packet *pkt, rs_avp ***vps)
 {
-  assert (conn);
-  assert (pkt->rpkt);
-
-  if (_conn_open (conn, pkt))
-    return -1;
-  assert (conn->evb);
-  assert (conn->bev);
-  assert (conn->active_peer);
-  assert (conn->active_peer->s >= 0);
-
-  event_base_dispatch (conn->evb);
+  assert (pkt);
+  *vps = &pkt->rpkt->vps;
+}
 
-#if defined (DEBUG)
-  fprintf (stderr, "%s: event loop done\n", __func__);
-  assert (event_base_got_break(conn->evb));
-#endif
+unsigned int
+rs_packet_code (struct rs_packet *pkt)
+{
+  assert (pkt);
+  return pkt->rpkt->code;
+}
 
-  return RSE_OK;
+rs_const_avp *
+rs_packet_find_avp (struct rs_packet *pkt, unsigned int attr, unsigned int vendor)
+{
+  assert (pkt);
+  return rs_avp_find_const (pkt->rpkt->vps, attr, vendor);
 }
 
 int
-rs_packet_receive(struct rs_connection *conn, struct rs_packet **pkt_out)
+rs_packet_set_id (struct rs_packet *pkt, int id)
 {
-  struct rs_packet *pkt;
+  int old = pkt->rpkt->id;
 
-  assert (conn);
+  pkt->rpkt->id = id;
 
-  if (_packet_create (conn, pkt_out))
-    return -1;
-  pkt = *pkt_out;
-  pkt->conn = conn;
-
-  if (_conn_open (conn, pkt))
-    return -1;
-  assert (conn->evb);
-  assert (conn->bev);
-  assert (conn->active_peer);
-  assert (conn->active_peer->s >= 0);
-
-  bufferevent_setwatermark (conn->bev, EV_READ, 4, 0);
-  bufferevent_enable (conn->bev, EV_READ);
-  event_base_dispatch (conn->evb);
-#if defined (DEBUG)
-  fprintf (stderr, "%s: event loop done\n", __func__);
-  assert (event_base_got_break(conn->evb));
-#endif
-
-#if defined (DEBUG)
-  fprintf (stderr, "%s: got this:\n", __func__);
-  rs_dump_packet (pkt);
-#endif
-
-  return RSE_OK;
-}
-
-void
-rs_packet_add_attr(struct rs_packet *pkt, struct rs_attr *attr)
-{
-  pairadd (&pkt->rpkt->vps, attr->vp);
-  attr->pkt = pkt;
+  return old;
 }