src/modules/rlm_eap/mem.c

   1 /*
   2  * mem.c  Memory allocation, deallocation stuff.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2001,2006  The FreeRADIUS server project
  21  * Copyright 2001  hereUare Communications, Inc. <raghud@hereuare.com>
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include <stdio.h>
  28 #include "rlm_eap.h"
  29
  30 #ifdef HAVE_PTHREAD_H
  31 #define PTHREAD_MUTEX_LOCK pthread_mutex_lock
  32 #define PTHREAD_MUTEX_UNLOCK pthread_mutex_unlock
  33 #else
  34 #define PTHREAD_MUTEX_LOCK(_x)
  35 #define PTHREAD_MUTEX_UNLOCK(_x)
  36 #endif
  37
  38 /*
  39  * Allocate a new EAP_PACKET
  40  */
  41 EAP_PACKET *eap_packet_alloc(void)
  42 {
  43         EAP_PACKET   *rp;
  44
  45         rp = rad_malloc(sizeof(EAP_PACKET));
  46         memset(rp, 0, sizeof(EAP_PACKET));
  47         return rp;
  48 }
  49
  50 /*
  51  * Free EAP_PACKET
  52  */
  53 void eap_packet_free(EAP_PACKET **eap_packet_ptr)
  54 {
  55         EAP_PACKET *eap_packet;
  56
  57         if (!eap_packet_ptr) return;
  58         eap_packet = *eap_packet_ptr;
  59         if (!eap_packet) return;
  60
  61         if (eap_packet->type.data) {
  62                 /*
  63                  *      There's no packet, OR the type data isn't
  64                  *      pointing inside of the packet: free it.
  65                  */
  66                 if ((eap_packet->packet == NULL) ||
  67                     (eap_packet->type.data != (eap_packet->packet + 5))) {
  68                         free(eap_packet->type.data);
  69                 }
  70                 eap_packet->type.data = NULL;
  71         }
  72
  73         if (eap_packet->packet) {
  74                 free(eap_packet->packet);
  75                 eap_packet->packet = NULL;
  76         }
  77
  78         free(eap_packet);
  79
  80         *eap_packet_ptr = NULL;
  81 }
  82
  83 /*
  84  * Allocate a new EAP_PACKET
  85  */
  86 EAP_DS *eap_ds_alloc(void)
  87 {
  88         EAP_DS  *eap_ds;
  89
  90         eap_ds = rad_malloc(sizeof(EAP_DS));
  91         memset(eap_ds, 0, sizeof(EAP_DS));
  92         if ((eap_ds->response = eap_packet_alloc()) == NULL) {
  93                 eap_ds_free(&eap_ds);
  94                 return NULL;
  95         }
  96         if ((eap_ds->request = eap_packet_alloc()) == NULL) {
  97                 eap_ds_free(&eap_ds);
  98                 return NULL;
  99         }
 100
 101         return eap_ds;
 102 }
 103
 104 void eap_ds_free(EAP_DS **eap_ds_p)
 105 {
 106         EAP_DS *eap_ds;
 107
 108         if (!eap_ds_p) return;
 109
 110         eap_ds = *eap_ds_p;
 111         if (!eap_ds) return;
 112
 113         if (eap_ds->response) eap_packet_free(&(eap_ds->response));
 114         if (eap_ds->request) eap_packet_free(&(eap_ds->request));
 115
 116         free(eap_ds);
 117         *eap_ds_p = NULL;
 118 }
 119
 120 /*
 121  * Allocate a new EAP_HANDLER
 122  */
 123 EAP_HANDLER *eap_handler_alloc(rlm_eap_t *inst)
 124 {
 125         EAP_HANDLER     *handler;
 126
 127         handler = rad_malloc(sizeof(EAP_HANDLER));
 128         memset(handler, 0, sizeof(EAP_HANDLER));
 129
 130         if (fr_debug_flag && inst->handler_tree) {
 131                 PTHREAD_MUTEX_LOCK(&(inst->handler_mutex));
 132                 rbtree_insert(inst->handler_tree, handler);
 133                 PTHREAD_MUTEX_UNLOCK(&(inst->handler_mutex));
 134
 135         }
 136         return handler;
 137 }
 138
 139 void eap_handler_free(rlm_eap_t *inst, EAP_HANDLER *handler)
 140 {
 141         if (!handler)
 142                 return;
 143
 144         if (inst->handler_tree) {
 145                 PTHREAD_MUTEX_LOCK(&(inst->handler_mutex));
 146                 rbtree_deletebydata(inst->handler_tree, handler);
 147                 PTHREAD_MUTEX_UNLOCK(&(inst->handler_mutex));
 148         }
 149
 150         if (handler->identity) {
 151                 free(handler->identity);
 152                 handler->identity = NULL;
 153         }
 154
 155         if (handler->prev_eapds) eap_ds_free(&(handler->prev_eapds));
 156         if (handler->eap_ds) eap_ds_free(&(handler->eap_ds));
 157
 158         if ((handler->opaque) && (handler->free_opaque)) {
 159                 handler->free_opaque(handler->opaque);
 160                 handler->opaque = NULL;
 161         }
 162         else if ((handler->opaque) && (handler->free_opaque == NULL))
 163                 radlog(L_ERR, "Possible memory leak ...");
 164
 165         handler->opaque = NULL;
 166         handler->free_opaque = NULL;
 167
 168         if (handler->certs) pairfree(&handler->certs);
 169
 170         free(handler);
 171 }
 172
 173
 174 typedef struct check_handler_t {
 175         rlm_eap_t       *inst;
 176         EAP_HANDLER     *handler;
 177         int             trips;
 178 } check_handler_t;
 179
 180 static void check_handler(void *data)
 181 {
 182         int do_warning = FALSE;
 183         uint8_t state[8];
 184         check_handler_t *check = data;
 185
 186         if (!check) return;
 187
 188         if (!check->inst || !check->handler) {
 189                 free(check);
 190                 return;
 191         }
 192
 193         PTHREAD_MUTEX_LOCK(&(check->inst->handler_mutex));
 194         if (!rbtree_finddata(check->inst->handler_tree, check->handler)) {
 195                 goto done;
 196         }
 197
 198         /*
 199          *      The session has continued *after* this packet.
 200          *      Don't do a warning.
 201          */
 202         if (check->handler->trips > check->trips) {
 203                 goto done;
 204         }
 205
 206         if (check->handler->tls && !check->handler->finished) {
 207                 do_warning = TRUE;
 208                 memcpy(state, check->handler->state, sizeof(state));
 209         }
 210
 211 done:
 212         PTHREAD_MUTEX_UNLOCK(&(check->inst->handler_mutex));
 213         free(check);
 214
 215         if (do_warning) {
 216                 DEBUG("WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 217                 DEBUG("WARNING: !! EAP session for state 0x%02x%02x%02x%02x%02x%02x%02x%02x did not finish!",
 218                       state[0], state[1],
 219                       state[2], state[3],
 220                       state[4], state[5],
 221                       state[6], state[7]);
 222
 223                 DEBUG("WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility");
 224                 DEBUG("WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 225         }
 226 }
 227
 228 void eaptype_free(EAP_TYPES *i)
 229 {
 230         if (i->type->detach) (i->type->detach)(i->type_data);
 231         i->type_data = NULL;
 232         if (i->handle) lt_dlclose(i->handle);
 233         free(i);
 234 }
 235
 236
 237 void eaplist_free(rlm_eap_t *inst)
 238 {
 239         EAP_HANDLER *node, *next;
 240
 241         for (node = inst->session_head; node != NULL; node = next) {
 242                 next = node->next;
 243                 eap_handler_free(inst, node);
 244         }
 245
 246         inst->session_head = inst->session_tail = NULL;
 247 }
 248
 249 /*
 250  *      Return a 32-bit random number.
 251  */
 252 static uint32_t eap_rand(fr_randctx *ctx)
 253 {
 254         uint32_t num;
 255
 256         num = ctx->randrsl[ctx->randcnt++];
 257         if (ctx->randcnt >= 256) {
 258                 ctx->randcnt = 0;
 259                 fr_isaac(ctx);
 260         }
 261
 262         return num;
 263 }
 264
 265
 266 static EAP_HANDLER *eaplist_delete(rlm_eap_t *inst, EAP_HANDLER *handler)
 267 {
 268         rbnode_t *node;
 269
 270         node = rbtree_find(inst->session_tree, handler);
 271         if (!node) return NULL;
 272
 273         handler = rbtree_node2data(inst->session_tree, node);
 274
 275         /*
 276          *      Delete old handler from the tree.
 277          */
 278         rbtree_delete(inst->session_tree, node);
 279
 280         /*
 281          *      And unsplice it from the linked list.
 282          */
 283         if (handler->prev) {
 284                 handler->prev->next = handler->next;
 285         } else {
 286                 inst->session_head = handler->next;
 287         }
 288         if (handler->next) {
 289                 handler->next->prev = handler->prev;
 290         } else {
 291                 inst->session_tail = handler->prev;
 292         }
 293         handler->prev = handler->next = NULL;
 294
 295         return handler;
 296 }
 297
 298
 299 static void eaplist_expire(rlm_eap_t *inst, time_t timestamp)
 300 {
 301         int i;
 302         EAP_HANDLER *handler;
 303
 304         /*
 305          *      Check the first few handlers in the list, and delete
 306          *      them if they're too old.  We don't need to check them
 307          *      all, as incoming requests will quickly cause older
 308          *      handlers to be deleted.
 309          *
 310          */
 311         for (i = 0; i < 3; i++) {
 312                 handler = inst->session_head;
 313                 if (!handler) break;
 314
 315                 /*
 316                  *      Expire entries from the start of the list.
 317                  *      They should be the oldest ones.
 318                  */
 319                 if ((timestamp - handler->timestamp) > inst->timer_limit) {
 320                         rbnode_t *node;
 321                         node = rbtree_find(inst->session_tree, handler);
 322                         rad_assert(node != NULL);
 323                         rbtree_delete(inst->session_tree, node);
 324
 325                         /*
 326                          *      handler == inst->session_head
 327                          */
 328                         inst->session_head = handler->next;
 329                         if (handler->next) {
 330                                 handler->next->prev = NULL;
 331                         } else {
 332                                 inst->session_head = NULL;
 333                                 inst->session_tail = NULL;
 334                         }
 335                         eap_handler_free(inst, handler);
 336                 }
 337         }
 338 }
 339
 340 /*
 341  *      Add a handler to the set of active sessions.
 342  *
 343  *      Since we're adding it to the list, we guess that this means
 344  *      the packet needs a State attribute.  So add one.
 345  */
 346 int eaplist_add(rlm_eap_t *inst, EAP_HANDLER *handler)
 347 {
 348         int             status = 0;
 349         VALUE_PAIR      *state;
 350         REQUEST         *request = handler->request;
 351
 352         rad_assert(handler != NULL);
 353         rad_assert(request != NULL);
 354
 355         /*
 356          *      Generate State, since we've been asked to add it to
 357          *      the list.
 358          */
 359         state = pairmake("State", "0x00", T_OP_EQ);
 360         if (!state) return 0;
 361
 362         /*
 363          *      The time at which this request was made was the time
 364          *      at which it was received by the RADIUS server.
 365          */
 366         handler->timestamp = request->timestamp;
 367         handler->status = 1;
 368
 369         handler->src_ipaddr = request->packet->src_ipaddr;
 370         handler->eap_id = handler->eap_ds->request->id;
 371
 372         /*
 373          *      Playing with a data structure shared among threads
 374          *      means that we need a lock, to avoid conflict.
 375          */
 376         PTHREAD_MUTEX_LOCK(&(inst->session_mutex));
 377
 378         /*
 379          *      If we have a DoS attack, discard new sessions.
 380          */
 381         if (rbtree_num_elements(inst->session_tree) >= inst->max_sessions) {
 382                 status = -1;
 383                 eaplist_expire(inst, handler->timestamp);
 384                 goto done;
 385         }
 386
 387         /*
 388          *      Create a unique content for the State variable.
 389          *      It will be modified slightly per round trip, but less so
 390          *      than in 1.x.
 391          */
 392         if (handler->trips == 0) {
 393                 int i;
 394
 395                 for (i = 0; i < 4; i++) {
 396                         uint32_t lvalue;
 397
 398                         lvalue = eap_rand(&inst->rand_pool);
 399
 400                         memcpy(handler->state + i * 4, &lvalue,
 401                                sizeof(lvalue));
 402                 }
 403         }
 404
 405         memcpy(state->vp_octets, handler->state, sizeof(handler->state));
 406         state->length = EAP_STATE_LEN;
 407
 408         /*
 409          *      Add some more data to distinguish the sessions.
 410          */
 411         state->vp_octets[4] = handler->trips ^ handler->state[0];
 412         state->vp_octets[5] = handler->eap_id ^ handler->state[1];
 413         state->vp_octets[6] = handler->eap_type ^ handler->state[2];
 414
 415         /*
 416          *      and copy the state back again.
 417          */
 418         memcpy(handler->state, state->vp_octets, sizeof(handler->state));
 419
 420         /*
 421          *      Big-time failure.
 422          */
 423         status = rbtree_insert(inst->session_tree, handler);
 424
 425         /*
 426          *      Catch Access-Challenge without response.
 427          */
 428         if (fr_debug_flag) {
 429                 check_handler_t *check = rad_malloc(sizeof(*check));
 430
 431                 check->inst = inst;
 432                 check->handler = handler;
 433                 check->trips = handler->trips;
 434                 request_data_add(request, inst, 0, check, check_handler);
 435         }
 436
 437         if (status) {
 438                 EAP_HANDLER *prev;
 439
 440                 prev = inst->session_tail;
 441                 if (prev) {
 442                         prev->next = handler;
 443                         handler->prev = prev;
 444                         handler->next = NULL;
 445                         inst->session_tail = handler;
 446                 } else {
 447                         inst->session_head = inst->session_tail = handler;
 448                         handler->next = handler->prev = NULL;
 449                 }
 450         }
 451
 452         /*
 453          *      Now that we've finished mucking with the list,
 454          *      unlock it.
 455          */
 456  done:
 457
 458         /*
 459          *      We don't need this any more.
 460          */
 461         if (status > 0) handler->request = NULL;
 462
 463         PTHREAD_MUTEX_UNLOCK(&(inst->session_mutex));
 464
 465         if (status <= 0) {
 466                 pairfree(&state);
 467
 468                 if (status < 0) {
 469                         static time_t last_logged = 0;
 470
 471                         if (last_logged < handler->timestamp) {
 472                                 last_logged = handler->timestamp;
 473                                 radlog(L_ERR, "rlm_eap: Too many open sessions.  Try increasing \"max_sessions\" in the EAP module configuration");
 474                         }
 475                 } else {
 476                         radlog(L_ERR, "rlm_eap: Internal error: failed to store handler");
 477                 }
 478                 return 0;
 479         }
 480
 481         pairadd(&(request->reply->vps), state);
 482
 483         return 1;
 484 }
 485
 486 /*
 487  *      Find a a previous EAP-Request sent by us, which matches
 488  *      the current EAP-Response.
 489  *
 490  *      Then, release the handle from the list, and return it to
 491  *      the caller.
 492  *
 493  *      Also since we fill the eap_ds with the present EAP-Response we
 494  *      got to free the prev_eapds & move the eap_ds to prev_eapds
 495  */
 496 EAP_HANDLER *eaplist_find(rlm_eap_t *inst, REQUEST *request,
 497                           eap_packet_t *eap_packet)
 498 {
 499         VALUE_PAIR      *state;
 500         EAP_HANDLER     *handler, myHandler;
 501
 502         /*
 503          *      We key the sessions off of the 'state' attribute, so it
 504          *      must exist.
 505          */
 506         state = pairfind(request->packet->vps, PW_STATE, 0);
 507         if (!state ||
 508             (state->length != EAP_STATE_LEN)) {
 509                 return NULL;
 510         }
 511
 512         myHandler.src_ipaddr = request->packet->src_ipaddr;
 513         myHandler.eap_id = eap_packet->id;
 514         memcpy(myHandler.state, state->vp_strvalue, sizeof(myHandler.state));
 515
 516         /*
 517          *      Playing with a data structure shared among threads
 518          *      means that we need a lock, to avoid conflict.
 519          */
 520         PTHREAD_MUTEX_LOCK(&(inst->session_mutex));
 521
 522         eaplist_expire(inst, request->timestamp);
 523
 524         handler = eaplist_delete(inst, &myHandler);
 525         PTHREAD_MUTEX_UNLOCK(&(inst->session_mutex));
 526
 527         /*
 528          *      Might not have been there.
 529          */
 530         if (!handler) {
 531                 radlog(L_ERR, "rlm_eap: No EAP session matching the State variable.");
 532                 return NULL;
 533         }
 534
 535         if (handler->trips >= 50) {
 536                 RDEBUG2("More than 50 authentication packets for this EAP session.  Aborted.");
 537                 eap_handler_free(inst, handler);
 538                 return NULL;
 539         }
 540         handler->trips++;
 541
 542         RDEBUG2("Request found, released from the list");
 543
 544         /*
 545          *      Remember what the previous request was.
 546          */
 547         eap_ds_free(&(handler->prev_eapds));
 548         handler->prev_eapds = handler->eap_ds;
 549         handler->eap_ds = NULL;
 550
 551         return handler;
 552 }