src/modules/rlm_eap/mem.c

   1 /*
   2  * mem.c  Memory allocation, deallocation stuff.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2001,2006  The FreeRADIUS server project
  21  * Copyright 2001  hereUare Communications, Inc. <raghud@hereuare.com>
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include <stdio.h>
  28 #include "rlm_eap.h"
  29
  30 /*
  31  * Allocate a new EAP_PACKET
  32  */
  33 EAP_PACKET *eap_packet_alloc(void)
  34 {
  35         EAP_PACKET   *rp;
  36
  37         rp = rad_malloc(sizeof(EAP_PACKET));
  38         memset(rp, 0, sizeof(EAP_PACKET));
  39         return rp;
  40 }
  41
  42 /*
  43  * Free EAP_PACKET
  44  */
  45 void eap_packet_free(EAP_PACKET **eap_packet_ptr)
  46 {
  47         EAP_PACKET *eap_packet;
  48
  49         if (!eap_packet_ptr) return;
  50         eap_packet = *eap_packet_ptr;
  51         if (!eap_packet) return;
  52
  53         if (eap_packet->type.data) {
  54                 /*
  55                  *      There's no packet, OR the type data isn't
  56                  *      pointing inside of the packet: free it.
  57                  */
  58                 if ((eap_packet->packet == NULL) ||
  59                     (eap_packet->type.data != (eap_packet->packet + 5))) {
  60                         free(eap_packet->type.data);
  61                 }
  62                 eap_packet->type.data = NULL;
  63         }
  64
  65         if (eap_packet->packet) {
  66                 free(eap_packet->packet);
  67                 eap_packet->packet = NULL;
  68         }
  69
  70         free(eap_packet);
  71
  72         *eap_packet_ptr = NULL;
  73 }
  74
  75 /*
  76  * Allocate a new EAP_PACKET
  77  */
  78 EAP_DS *eap_ds_alloc(void)
  79 {
  80         EAP_DS  *eap_ds;
  81
  82         eap_ds = rad_malloc(sizeof(EAP_DS));
  83         memset(eap_ds, 0, sizeof(EAP_DS));
  84         if ((eap_ds->response = eap_packet_alloc()) == NULL) {
  85                 eap_ds_free(&eap_ds);
  86                 return NULL;
  87         }
  88         if ((eap_ds->request = eap_packet_alloc()) == NULL) {
  89                 eap_ds_free(&eap_ds);
  90                 return NULL;
  91         }
  92
  93         return eap_ds;
  94 }
  95
  96 void eap_ds_free(EAP_DS **eap_ds_p)
  97 {
  98         EAP_DS *eap_ds;
  99
 100         if (!eap_ds_p) return;
 101
 102         eap_ds = *eap_ds_p;
 103         if (!eap_ds) return;
 104
 105         if (eap_ds->response) eap_packet_free(&(eap_ds->response));
 106         if (eap_ds->request) eap_packet_free(&(eap_ds->request));
 107
 108         free(eap_ds);
 109         *eap_ds_p = NULL;
 110 }
 111
 112 /*
 113  * Allocate a new EAP_HANDLER
 114  */
 115 EAP_HANDLER *eap_handler_alloc(rlm_eap_t *inst)
 116 {
 117         EAP_HANDLER     *handler;
 118
 119         handler = rad_malloc(sizeof(EAP_HANDLER));
 120         memset(handler, 0, sizeof(EAP_HANDLER));
 121
 122         if (fr_debug_flag && inst->handler_tree) {
 123                 pthread_mutex_lock(&(inst->handler_mutex));
 124                 rbtree_insert(inst->handler_tree, handler);
 125                 pthread_mutex_unlock(&(inst->handler_mutex));
 126
 127         }
 128         return handler;
 129 }
 130
 131 void eap_handler_free(rlm_eap_t *inst, EAP_HANDLER *handler)
 132 {
 133         if (!handler)
 134                 return;
 135
 136         if (inst->handler_tree) {
 137                 pthread_mutex_lock(&(inst->handler_mutex));
 138                 rbtree_deletebydata(inst->handler_tree, handler);
 139                 pthread_mutex_unlock(&(inst->handler_mutex));
 140         }
 141
 142         if (handler->identity) {
 143                 free(handler->identity);
 144                 handler->identity = NULL;
 145         }
 146
 147         if (handler->prev_eapds) eap_ds_free(&(handler->prev_eapds));
 148         if (handler->eap_ds) eap_ds_free(&(handler->eap_ds));
 149
 150         if ((handler->opaque) && (handler->free_opaque)) {
 151                 handler->free_opaque(handler->opaque);
 152                 handler->opaque = NULL;
 153         }
 154         else if ((handler->opaque) && (handler->free_opaque == NULL))
 155                 radlog(L_ERR, "Possible memory leak ...");
 156
 157         handler->opaque = NULL;
 158         handler->free_opaque = NULL;
 159
 160         if (handler->certs) pairfree(&handler->certs);
 161
 162         free(handler);
 163 }
 164
 165
 166 typedef struct check_handler_t {
 167         rlm_eap_t       *inst;
 168         EAP_HANDLER     *handler;
 169         int             trips;
 170 } check_handler_t;
 171
 172 static void check_handler(void *data)
 173 {
 174         check_handler_t *check = data;
 175
 176         if (!check) return;
 177         if (!check->inst || !check->handler) {
 178                 free(check);
 179                 return;
 180         }
 181
 182         pthread_mutex_lock(&(check->inst->session_mutex));
 183         if (!rbtree_finddata(check->inst->handler_tree, check->handler)) {
 184                 goto done;
 185         }
 186
 187         if (check->handler->trips > check->trips) {
 188                 goto done;
 189         }
 190
 191         if (check->handler->tls && !check->handler->finished) {
 192                 DEBUG("WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 193                 DEBUG("WARNING: !! EAP session for state 0x%02x%02x%02x%02x%02x%02x%02x%02x did not finish!",
 194                       check->handler->state[0], check->handler->state[1],
 195                       check->handler->state[2], check->handler->state[3],
 196                       check->handler->state[4], check->handler->state[5],
 197                       check->handler->state[6], check->handler->state[7]);
 198
 199                 DEBUG("WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility");
 200                 DEBUG("WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 201         }
 202
 203 done:
 204         pthread_mutex_unlock(&(check->inst->session_mutex));
 205         free(check);
 206 }
 207
 208 void eaptype_free(EAP_TYPES *i)
 209 {
 210         if (i->type->detach) (i->type->detach)(i->type_data);
 211         i->type_data = NULL;
 212         if (i->handle) lt_dlclose(i->handle);
 213         free(i);
 214 }
 215
 216
 217 void eaplist_free(rlm_eap_t *inst)
 218 {
 219         EAP_HANDLER *node, *next;
 220
 221         for (node = inst->session_head; node != NULL; node = next) {
 222                 next = node->next;
 223                 eap_handler_free(inst, node);
 224         }
 225
 226         inst->session_head = inst->session_tail = NULL;
 227 }
 228
 229 /*
 230  *      Return a 32-bit random number.
 231  */
 232 static uint32_t eap_rand(fr_randctx *ctx)
 233 {
 234         uint32_t num;
 235
 236         num = ctx->randrsl[ctx->randcnt++];
 237         if (ctx->randcnt >= 256) {
 238                 ctx->randcnt = 0;
 239                 fr_isaac(ctx);
 240         }
 241
 242         return num;
 243 }
 244
 245
 246 static EAP_HANDLER *eaplist_delete(rlm_eap_t *inst, EAP_HANDLER *handler)
 247 {
 248         rbnode_t *node;
 249
 250         node = rbtree_find(inst->session_tree, handler);
 251         if (!node) return NULL;
 252
 253         handler = rbtree_node2data(inst->session_tree, node);
 254
 255         /*
 256          *      Delete old handler from the tree.
 257          */
 258         rbtree_delete(inst->session_tree, node);
 259
 260         /*
 261          *      And unsplice it from the linked list.
 262          */
 263         if (handler->prev) {
 264                 handler->prev->next = handler->next;
 265         } else {
 266                 inst->session_head = handler->next;
 267         }
 268         if (handler->next) {
 269                 handler->next->prev = handler->prev;
 270         } else {
 271                 inst->session_tail = handler->prev;
 272         }
 273         handler->prev = handler->next = NULL;
 274
 275         return handler;
 276 }
 277
 278
 279 static void eaplist_expire(rlm_eap_t *inst, time_t timestamp)
 280 {
 281         int i;
 282         EAP_HANDLER *handler;
 283
 284         /*
 285          *      Check the first few handlers in the list, and delete
 286          *      them if they're too old.  We don't need to check them
 287          *      all, as incoming requests will quickly cause older
 288          *      handlers to be deleted.
 289          *
 290          */
 291         for (i = 0; i < 3; i++) {
 292                 handler = inst->session_head;
 293                 if (!handler) break;
 294
 295                 /*
 296                  *      Expire entries from the start of the list.
 297                  *      They should be the oldest ones.
 298                  */
 299                 if ((timestamp - handler->timestamp) > inst->timer_limit) {
 300                         rbnode_t *node;
 301                         node = rbtree_find(inst->session_tree, handler);
 302                         rad_assert(node != NULL);
 303                         rbtree_delete(inst->session_tree, node);
 304
 305                         /*
 306                          *      handler == inst->session_head
 307                          */
 308                         inst->session_head = handler->next;
 309                         if (handler->next) {
 310                                 handler->next->prev = NULL;
 311                         } else {
 312                                 inst->session_head = NULL;
 313                                 inst->session_tail = NULL;
 314                         }
 315                         eap_handler_free(inst, handler);
 316                 }
 317         }
 318 }
 319
 320 /*
 321  *      Add a handler to the set of active sessions.
 322  *
 323  *      Since we're adding it to the list, we guess that this means
 324  *      the packet needs a State attribute.  So add one.
 325  */
 326 int eaplist_add(rlm_eap_t *inst, EAP_HANDLER *handler)
 327 {
 328         int             status = 0;
 329         VALUE_PAIR      *state;
 330         REQUEST         *request = handler->request;
 331
 332         rad_assert(handler != NULL);
 333         rad_assert(request != NULL);
 334
 335         /*
 336          *      Generate State, since we've been asked to add it to
 337          *      the list.
 338          */
 339         state = pairmake("State", "0x00", T_OP_EQ);
 340         if (!state) return 0;
 341
 342         /*
 343          *      The time at which this request was made was the time
 344          *      at which it was received by the RADIUS server.
 345          */
 346         handler->timestamp = request->timestamp;
 347         handler->status = 1;
 348
 349         handler->src_ipaddr = request->packet->src_ipaddr;
 350         handler->eap_id = handler->eap_ds->request->id;
 351
 352         /*
 353          *      Playing with a data structure shared among threads
 354          *      means that we need a lock, to avoid conflict.
 355          */
 356         pthread_mutex_lock(&(inst->session_mutex));
 357
 358         /*
 359          *      If we have a DoS attack, discard new sessions.
 360          */
 361         if (rbtree_num_elements(inst->session_tree) >= inst->max_sessions) {
 362                 status = -1;
 363                 eaplist_expire(inst, handler->timestamp);
 364                 goto done;
 365         }
 366
 367         /*
 368          *      Create a unique content for the State variable.
 369          *      It will be modified slightly per round trip, but less so
 370          *      than in 1.x.
 371          */
 372         if (handler->trips == 0) {
 373                 int i;
 374
 375                 for (i = 0; i < 4; i++) {
 376                         uint32_t lvalue;
 377
 378                         lvalue = eap_rand(&inst->rand_pool);
 379
 380                         memcpy(handler->state + i * 4, &lvalue,
 381                                sizeof(lvalue));
 382                 }
 383         }
 384
 385         memcpy(state->vp_octets, handler->state, sizeof(handler->state));
 386         state->length = EAP_STATE_LEN;
 387
 388         /*
 389          *      Add some more data to distinguish the sessions.
 390          */
 391         state->vp_octets[4] = handler->trips ^ handler->state[0];
 392         state->vp_octets[5] = handler->eap_id ^ handler->state[1];
 393         state->vp_octets[6] = handler->eap_type ^ handler->state[2];
 394
 395         /*
 396          *      and copy the state back again.
 397          */
 398         memcpy(handler->state, state->vp_octets, sizeof(handler->state));
 399
 400         /*
 401          *      Big-time failure.
 402          */
 403         status = rbtree_insert(inst->session_tree, handler);
 404
 405         /*
 406          *      Catch Access-Challenge without response.
 407          */
 408         if (fr_debug_flag) {
 409                 check_handler_t *check = rad_malloc(sizeof(*check));
 410
 411                 check->inst = inst;
 412                 check->handler = handler;
 413                 check->trips = handler->trips;
 414                 request_data_add(request, inst, 0, check, check_handler);
 415         }
 416
 417         if (status) {
 418                 EAP_HANDLER *prev;
 419
 420                 prev = inst->session_tail;
 421                 if (prev) {
 422                         prev->next = handler;
 423                         handler->prev = prev;
 424                         handler->next = NULL;
 425                         inst->session_tail = handler;
 426                 } else {
 427                         inst->session_head = inst->session_tail = handler;
 428                         handler->next = handler->prev = NULL;
 429                 }
 430         }
 431
 432         /*
 433          *      Now that we've finished mucking with the list,
 434          *      unlock it.
 435          */
 436  done:
 437
 438         /*
 439          *      We don't need this any more.
 440          */
 441         if (status > 0) handler->request = NULL;
 442
 443         pthread_mutex_unlock(&(inst->session_mutex));
 444
 445         if (status <= 0) {
 446                 pairfree(&state);
 447
 448                 if (status < 0) {
 449                         static time_t last_logged = 0;
 450
 451                         if (last_logged < handler->timestamp) {
 452                                 last_logged = handler->timestamp;
 453                                 radlog(L_ERR, "rlm_eap: Too many open sessions.  Try increasing \"max_sessions\" in the EAP module configuration");
 454                         }
 455                 } else {
 456                         radlog(L_ERR, "rlm_eap: Internal error: failed to store handler");
 457                 }
 458                 return 0;
 459         }
 460
 461         pairadd(&(request->reply->vps), state);
 462
 463         return 1;
 464 }
 465
 466 /*
 467  *      Find a a previous EAP-Request sent by us, which matches
 468  *      the current EAP-Response.
 469  *
 470  *      Then, release the handle from the list, and return it to
 471  *      the caller.
 472  *
 473  *      Also since we fill the eap_ds with the present EAP-Response we
 474  *      got to free the prev_eapds & move the eap_ds to prev_eapds
 475  */
 476 EAP_HANDLER *eaplist_find(rlm_eap_t *inst, REQUEST *request,
 477                           eap_packet_t *eap_packet)
 478 {
 479         VALUE_PAIR      *state;
 480         EAP_HANDLER     *handler, myHandler;
 481
 482         /*
 483          *      We key the sessions off of the 'state' attribute, so it
 484          *      must exist.
 485          */
 486         state = pairfind(request->packet->vps, PW_STATE, 0);
 487         if (!state ||
 488             (state->length != EAP_STATE_LEN)) {
 489                 return NULL;
 490         }
 491
 492         myHandler.src_ipaddr = request->packet->src_ipaddr;
 493         myHandler.eap_id = eap_packet->id;
 494         memcpy(myHandler.state, state->vp_strvalue, sizeof(myHandler.state));
 495
 496         /*
 497          *      Playing with a data structure shared among threads
 498          *      means that we need a lock, to avoid conflict.
 499          */
 500         pthread_mutex_lock(&(inst->session_mutex));
 501
 502         eaplist_expire(inst, request->timestamp);
 503
 504         handler = eaplist_delete(inst, &myHandler);
 505         pthread_mutex_unlock(&(inst->session_mutex));
 506
 507         /*
 508          *      Might not have been there.
 509          */
 510         if (!handler) {
 511                 radlog(L_ERR, "rlm_eap: No EAP session matching the State variable.");
 512                 return NULL;
 513         }
 514
 515         if (handler->trips >= 50) {
 516                 RDEBUG2("More than 50 authentication packets for this EAP session.  Aborted.");
 517                 eap_handler_free(inst, handler);
 518                 return NULL;
 519         }
 520         handler->trips++;
 521
 522         RDEBUG2("Request found, released from the list");
 523
 524         /*
 525          *      Remember what the previous request was.
 526          */
 527         eap_ds_free(&(handler->prev_eapds));
 528         handler->prev_eapds = handler->eap_ds;
 529         handler->eap_ds = NULL;
 530
 531         return handler;
 532 }