src/radius/radius_client.c

   1 /*
   2  * hostapd / RADIUS client
   3  * Copyright (c) 2002-2005, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "radius.h"
  19 #include "radius_client.h"
  20 #include "eloop.h"
  21
  22 /* Defaults for RADIUS retransmit values (exponential backoff) */
  23 #define RADIUS_CLIENT_FIRST_WAIT 3 /* seconds */
  24 #define RADIUS_CLIENT_MAX_WAIT 120 /* seconds */
  25 #define RADIUS_CLIENT_MAX_RETRIES 10 /* maximum number of retransmit attempts
  26                                       * before entry is removed from retransmit
  27                                       * list */
  28 #define RADIUS_CLIENT_MAX_ENTRIES 30 /* maximum number of entries in retransmit
  29                                       * list (oldest will be removed, if this
  30                                       * limit is exceeded) */
  31 #define RADIUS_CLIENT_NUM_FAILOVER 4 /* try to change RADIUS server after this
  32                                       * many failed retry attempts */
  33
  34
  35 struct radius_rx_handler {
  36         RadiusRxResult (*handler)(struct radius_msg *msg,
  37                                   struct radius_msg *req,
  38                                   u8 *shared_secret, size_t shared_secret_len,
  39                                   void *data);
  40         void *data;
  41 };
  42
  43
  44 /* RADIUS message retransmit list */
  45 struct radius_msg_list {
  46         u8 addr[ETH_ALEN]; /* STA/client address; used to find RADIUS messages
  47                             * for the same STA. */
  48         struct radius_msg *msg;
  49         RadiusType msg_type;
  50         os_time_t first_try;
  51         os_time_t next_try;
  52         int attempts;
  53         int next_wait;
  54         struct os_time last_attempt;
  55
  56         u8 *shared_secret;
  57         size_t shared_secret_len;
  58
  59         /* TODO: server config with failover to backup server(s) */
  60
  61         struct radius_msg_list *next;
  62 };
  63
  64
  65 struct radius_client_data {
  66         void *ctx;
  67         struct hostapd_radius_servers *conf;
  68
  69         int auth_serv_sock; /* socket for authentication RADIUS messages */
  70         int acct_serv_sock; /* socket for accounting RADIUS messages */
  71         int auth_serv_sock6;
  72         int acct_serv_sock6;
  73         int auth_sock; /* currently used socket */
  74         int acct_sock; /* currently used socket */
  75
  76         struct radius_rx_handler *auth_handlers;
  77         size_t num_auth_handlers;
  78         struct radius_rx_handler *acct_handlers;
  79         size_t num_acct_handlers;
  80
  81         struct radius_msg_list *msgs;
  82         size_t num_msgs;
  83
  84         u8 next_radius_identifier;
  85 };
  86
  87
  88 static int
  89 radius_change_server(struct radius_client_data *radius,
  90                      struct hostapd_radius_server *nserv,
  91                      struct hostapd_radius_server *oserv,
  92                      int sock, int sock6, int auth);
  93 static int radius_client_init_acct(struct radius_client_data *radius);
  94 static int radius_client_init_auth(struct radius_client_data *radius);
  95
  96
  97 static void radius_client_msg_free(struct radius_msg_list *req)
  98 {
  99         radius_msg_free(req->msg);
 100         os_free(req->msg);
 101         os_free(req);
 102 }
 103
 104
 105 int radius_client_register(struct radius_client_data *radius,
 106                            RadiusType msg_type,
 107                            RadiusRxResult (*handler)(struct radius_msg *msg,
 108                                                      struct radius_msg *req,
 109                                                      u8 *shared_secret,
 110                                                      size_t shared_secret_len,
 111                                                      void *data),
 112                            void *data)
 113 {
 114         struct radius_rx_handler **handlers, *newh;
 115         size_t *num;
 116
 117         if (msg_type == RADIUS_ACCT) {
 118                 handlers = &radius->acct_handlers;
 119                 num = &radius->num_acct_handlers;
 120         } else {
 121                 handlers = &radius->auth_handlers;
 122                 num = &radius->num_auth_handlers;
 123         }
 124
 125         newh = os_realloc(*handlers,
 126                           (*num + 1) * sizeof(struct radius_rx_handler));
 127         if (newh == NULL)
 128                 return -1;
 129
 130         newh[*num].handler = handler;
 131         newh[*num].data = data;
 132         (*num)++;
 133         *handlers = newh;
 134
 135         return 0;
 136 }
 137
 138
 139 static void radius_client_handle_send_error(struct radius_client_data *radius,
 140                                             int s, RadiusType msg_type)
 141 {
 142 #ifndef CONFIG_NATIVE_WINDOWS
 143         int _errno = errno;
 144         perror("send[RADIUS]");
 145         if (_errno == ENOTCONN || _errno == EDESTADDRREQ || _errno == EINVAL ||
 146             _errno == EBADF) {
 147                 hostapd_logger(radius->ctx, NULL, HOSTAPD_MODULE_RADIUS,
 148                                HOSTAPD_LEVEL_INFO,
 149                                "Send failed - maybe interface status changed -"
 150                                " try to connect again");
 151                 eloop_unregister_read_sock(s);
 152                 close(s);
 153                 if (msg_type == RADIUS_ACCT || msg_type == RADIUS_ACCT_INTERIM)
 154                         radius_client_init_acct(radius);
 155                 else
 156                         radius_client_init_auth(radius);
 157         }
 158 #endif /* CONFIG_NATIVE_WINDOWS */
 159 }
 160
 161
 162 static int radius_client_retransmit(struct radius_client_data *radius,
 163                                     struct radius_msg_list *entry,
 164                                     os_time_t now)
 165 {
 166         struct hostapd_radius_servers *conf = radius->conf;
 167         int s;
 168
 169         if (entry->msg_type == RADIUS_ACCT ||
 170             entry->msg_type == RADIUS_ACCT_INTERIM) {
 171                 s = radius->acct_sock;
 172                 if (entry->attempts == 0)
 173                         conf->acct_server->requests++;
 174                 else {
 175                         conf->acct_server->timeouts++;
 176                         conf->acct_server->retransmissions++;
 177                 }
 178         } else {
 179                 s = radius->auth_sock;
 180                 if (entry->attempts == 0)
 181                         conf->auth_server->requests++;
 182                 else {
 183                         conf->auth_server->timeouts++;
 184                         conf->auth_server->retransmissions++;
 185                 }
 186         }
 187
 188         /* retransmit; remove entry if too many attempts */
 189         entry->attempts++;
 190         hostapd_logger(radius->ctx, entry->addr, HOSTAPD_MODULE_RADIUS,
 191                        HOSTAPD_LEVEL_DEBUG, "Resending RADIUS message (id=%d)",
 192                        entry->msg->hdr->identifier);
 193
 194         os_get_time(&entry->last_attempt);
 195         if (send(s, entry->msg->buf, entry->msg->buf_used, 0) < 0)
 196                 radius_client_handle_send_error(radius, s, entry->msg_type);
 197
 198         entry->next_try = now + entry->next_wait;
 199         entry->next_wait *= 2;
 200         if (entry->next_wait > RADIUS_CLIENT_MAX_WAIT)
 201                 entry->next_wait = RADIUS_CLIENT_MAX_WAIT;
 202         if (entry->attempts >= RADIUS_CLIENT_MAX_RETRIES) {
 203                 printf("Removing un-ACKed RADIUS message due to too many "
 204                        "failed retransmit attempts\n");
 205                 return 1;
 206         }
 207
 208         return 0;
 209 }
 210
 211
 212 static void radius_client_timer(void *eloop_ctx, void *timeout_ctx)
 213 {
 214         struct radius_client_data *radius = eloop_ctx;
 215         struct hostapd_radius_servers *conf = radius->conf;
 216         struct os_time now;
 217         os_time_t first;
 218         struct radius_msg_list *entry, *prev, *tmp;
 219         int auth_failover = 0, acct_failover = 0;
 220         char abuf[50];
 221
 222         entry = radius->msgs;
 223         if (!entry)
 224                 return;
 225
 226         os_get_time(&now);
 227         first = 0;
 228
 229         prev = NULL;
 230         while (entry) {
 231                 if (now.sec >= entry->next_try &&
 232                     radius_client_retransmit(radius, entry, now.sec)) {
 233                         if (prev)
 234                                 prev->next = entry->next;
 235                         else
 236                                 radius->msgs = entry->next;
 237
 238                         tmp = entry;
 239                         entry = entry->next;
 240                         radius_client_msg_free(tmp);
 241                         radius->num_msgs--;
 242                         continue;
 243                 }
 244
 245                 if (entry->attempts > RADIUS_CLIENT_NUM_FAILOVER) {
 246                         if (entry->msg_type == RADIUS_ACCT ||
 247                             entry->msg_type == RADIUS_ACCT_INTERIM)
 248                                 acct_failover++;
 249                         else
 250                                 auth_failover++;
 251                 }
 252
 253                 if (first == 0 || entry->next_try < first)
 254                         first = entry->next_try;
 255
 256                 prev = entry;
 257                 entry = entry->next;
 258         }
 259
 260         if (radius->msgs) {
 261                 if (first < now.sec)
 262                         first = now.sec;
 263                 eloop_register_timeout(first - now.sec, 0,
 264                                        radius_client_timer, radius, NULL);
 265                 hostapd_logger(radius->ctx, NULL, HOSTAPD_MODULE_RADIUS,
 266                                HOSTAPD_LEVEL_DEBUG, "Next RADIUS client "
 267                                "retransmit in %ld seconds",
 268                                (long int) (first - now.sec));
 269         }
 270
 271         if (auth_failover && conf->num_auth_servers > 1) {
 272                 struct hostapd_radius_server *next, *old;
 273                 old = conf->auth_server;
 274                 hostapd_logger(radius->ctx, NULL, HOSTAPD_MODULE_RADIUS,
 275                                HOSTAPD_LEVEL_NOTICE,
 276                                "No response from Authentication server "
 277                                "%s:%d - failover",
 278                                hostapd_ip_txt(&old->addr, abuf, sizeof(abuf)),
 279                                old->port);
 280
 281                 for (entry = radius->msgs; entry; entry = entry->next) {
 282                         if (entry->msg_type == RADIUS_AUTH)
 283                                 old->timeouts++;
 284                 }
 285
 286                 next = old + 1;
 287                 if (next > &(conf->auth_servers[conf->num_auth_servers - 1]))
 288                         next = conf->auth_servers;
 289                 conf->auth_server = next;
 290                 radius_change_server(radius, next, old,
 291                                      radius->auth_serv_sock,
 292                                      radius->auth_serv_sock6, 1);
 293         }
 294
 295         if (acct_failover && conf->num_acct_servers > 1) {
 296                 struct hostapd_radius_server *next, *old;
 297                 old = conf->acct_server;
 298                 hostapd_logger(radius->ctx, NULL, HOSTAPD_MODULE_RADIUS,
 299                                HOSTAPD_LEVEL_NOTICE,
 300                                "No response from Accounting server "
 301                                "%s:%d - failover",
 302                                hostapd_ip_txt(&old->addr, abuf, sizeof(abuf)),
 303                                old->port);
 304
 305                 for (entry = radius->msgs; entry; entry = entry->next) {
 306                         if (entry->msg_type == RADIUS_ACCT ||
 307                             entry->msg_type == RADIUS_ACCT_INTERIM)
 308                                 old->timeouts++;
 309                 }
 310
 311                 next = old + 1;
 312                 if (next > &conf->acct_servers[conf->num_acct_servers - 1])
 313                         next = conf->acct_servers;
 314                 conf->acct_server = next;
 315                 radius_change_server(radius, next, old,
 316                                      radius->acct_serv_sock,
 317                                      radius->acct_serv_sock6, 0);
 318         }
 319 }
 320
 321
 322 static void radius_client_update_timeout(struct radius_client_data *radius)
 323 {
 324         struct os_time now;
 325         os_time_t first;
 326         struct radius_msg_list *entry;
 327
 328         eloop_cancel_timeout(radius_client_timer, radius, NULL);
 329
 330         if (radius->msgs == NULL) {
 331                 return;
 332         }
 333
 334         first = 0;
 335         for (entry = radius->msgs; entry; entry = entry->next) {
 336                 if (first == 0 || entry->next_try < first)
 337                         first = entry->next_try;
 338         }
 339
 340         os_get_time(&now);
 341         if (first < now.sec)
 342                 first = now.sec;
 343         eloop_register_timeout(first - now.sec, 0, radius_client_timer, radius,
 344                                NULL);
 345         hostapd_logger(radius->ctx, NULL, HOSTAPD_MODULE_RADIUS,
 346                        HOSTAPD_LEVEL_DEBUG, "Next RADIUS client retransmit in"
 347                        " %ld seconds\n", (long int) (first - now.sec));
 348 }
 349
 350
 351 static void radius_client_list_add(struct radius_client_data *radius,
 352                                    struct radius_msg *msg,
 353                                    RadiusType msg_type, u8 *shared_secret,
 354                                    size_t shared_secret_len, const u8 *addr)
 355 {
 356         struct radius_msg_list *entry, *prev;
 357
 358         if (eloop_terminated()) {
 359                 /* No point in adding entries to retransmit queue since event
 360                  * loop has already been terminated. */
 361                 radius_msg_free(msg);
 362                 os_free(msg);
 363                 return;
 364         }
 365
 366         entry = os_zalloc(sizeof(*entry));
 367         if (entry == NULL) {
 368                 printf("Failed to add RADIUS packet into retransmit list\n");
 369                 radius_msg_free(msg);
 370                 os_free(msg);
 371                 return;
 372         }
 373
 374         if (addr)
 375                 os_memcpy(entry->addr, addr, ETH_ALEN);
 376         entry->msg = msg;
 377         entry->msg_type = msg_type;
 378         entry->shared_secret = shared_secret;
 379         entry->shared_secret_len = shared_secret_len;
 380         os_get_time(&entry->last_attempt);
 381         entry->first_try = entry->last_attempt.sec;
 382         entry->next_try = entry->first_try + RADIUS_CLIENT_FIRST_WAIT;
 383         entry->attempts = 1;
 384         entry->next_wait = RADIUS_CLIENT_FIRST_WAIT * 2;
 385         entry->next = radius->msgs;
 386         radius->msgs = entry;
 387         radius_client_update_timeout(radius);
 388
 389         if (radius->num_msgs >= RADIUS_CLIENT_MAX_ENTRIES) {
 390                 printf("Removing the oldest un-ACKed RADIUS packet due to "
 391                        "retransmit list limits.\n");
 392                 prev = NULL;
 393                 while (entry->next) {
 394                         prev = entry;
 395                         entry = entry->next;
 396                 }
 397                 if (prev) {
 398                         prev->next = NULL;
 399                         radius_client_msg_free(entry);
 400                 }
 401         } else
 402                 radius->num_msgs++;
 403 }
 404
 405
 406 static void radius_client_list_del(struct radius_client_data *radius,
 407                                    RadiusType msg_type, const u8 *addr)
 408 {
 409         struct radius_msg_list *entry, *prev, *tmp;
 410
 411         if (addr == NULL)
 412                 return;
 413
 414         entry = radius->msgs;
 415         prev = NULL;
 416         while (entry) {
 417                 if (entry->msg_type == msg_type &&
 418                     os_memcmp(entry->addr, addr, ETH_ALEN) == 0) {
 419                         if (prev)
 420                                 prev->next = entry->next;
 421                         else
 422                                 radius->msgs = entry->next;
 423                         tmp = entry;
 424                         entry = entry->next;
 425                         hostapd_logger(radius->ctx, addr,
 426                                        HOSTAPD_MODULE_RADIUS,
 427                                        HOSTAPD_LEVEL_DEBUG,
 428                                        "Removing matching RADIUS message");
 429                         radius_client_msg_free(tmp);
 430                         radius->num_msgs--;
 431                         continue;
 432                 }
 433                 prev = entry;
 434                 entry = entry->next;
 435         }
 436 }
 437
 438
 439 int radius_client_send(struct radius_client_data *radius,
 440                        struct radius_msg *msg, RadiusType msg_type,
 441                        const u8 *addr)
 442 {
 443         struct hostapd_radius_servers *conf = radius->conf;
 444         u8 *shared_secret;
 445         size_t shared_secret_len;
 446         char *name;
 447         int s, res;
 448
 449         if (msg_type == RADIUS_ACCT_INTERIM) {
 450                 /* Remove any pending interim acct update for the same STA. */
 451                 radius_client_list_del(radius, msg_type, addr);
 452         }
 453
 454         if (msg_type == RADIUS_ACCT || msg_type == RADIUS_ACCT_INTERIM) {
 455                 if (conf->acct_server == NULL) {
 456                         hostapd_logger(radius->ctx, NULL,
 457                                        HOSTAPD_MODULE_RADIUS,
 458                                        HOSTAPD_LEVEL_INFO,
 459                                        "No accounting server configured");
 460                         return -1;
 461                 }
 462                 shared_secret = conf->acct_server->shared_secret;
 463                 shared_secret_len = conf->acct_server->shared_secret_len;
 464                 radius_msg_finish_acct(msg, shared_secret, shared_secret_len);
 465                 name = "accounting";
 466                 s = radius->acct_sock;
 467                 conf->acct_server->requests++;
 468         } else {
 469                 if (conf->auth_server == NULL) {
 470                         hostapd_logger(radius->ctx, NULL,
 471                                        HOSTAPD_MODULE_RADIUS,
 472                                        HOSTAPD_LEVEL_INFO,
 473                                        "No authentication server configured");
 474                         return -1;
 475                 }
 476                 shared_secret = conf->auth_server->shared_secret;
 477                 shared_secret_len = conf->auth_server->shared_secret_len;
 478                 radius_msg_finish(msg, shared_secret, shared_secret_len);
 479                 name = "authentication";
 480                 s = radius->auth_sock;
 481                 conf->auth_server->requests++;
 482         }
 483
 484         hostapd_logger(radius->ctx, NULL, HOSTAPD_MODULE_RADIUS,
 485                        HOSTAPD_LEVEL_DEBUG, "Sending RADIUS message to %s "
 486                        "server", name);
 487         if (conf->msg_dumps)
 488                 radius_msg_dump(msg);
 489
 490         res = send(s, msg->buf, msg->buf_used, 0);
 491         if (res < 0)
 492                 radius_client_handle_send_error(radius, s, msg_type);
 493
 494         radius_client_list_add(radius, msg, msg_type, shared_secret,
 495                                shared_secret_len, addr);
 496
 497         return res;
 498 }
 499
 500
 501 static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
 502 {
 503         struct radius_client_data *radius = eloop_ctx;
 504         struct hostapd_radius_servers *conf = radius->conf;
 505         RadiusType msg_type = (RadiusType) sock_ctx;
 506         int len, roundtrip;
 507         unsigned char buf[3000];
 508         struct radius_msg *msg;
 509         struct radius_rx_handler *handlers;
 510         size_t num_handlers, i;
 511         struct radius_msg_list *req, *prev_req;
 512         struct os_time now;
 513         struct hostapd_radius_server *rconf;
 514         int invalid_authenticator = 0;
 515
 516         if (msg_type == RADIUS_ACCT) {
 517                 handlers = radius->acct_handlers;
 518                 num_handlers = radius->num_acct_handlers;
 519                 rconf = conf->acct_server;
 520         } else {
 521                 handlers = radius->auth_handlers;
 522                 num_handlers = radius->num_auth_handlers;
 523                 rconf = conf->auth_server;
 524         }
 525
 526         len = recv(sock, buf, sizeof(buf), MSG_DONTWAIT);
 527         if (len < 0) {
 528                 perror("recv[RADIUS]");
 529                 return;
 530         }
 531         hostapd_logger(radius->ctx, NULL, HOSTAPD_MODULE_RADIUS,
 532                        HOSTAPD_LEVEL_DEBUG, "Received %d bytes from RADIUS "
 533                        "server", len);
 534         if (len == sizeof(buf)) {
 535                 printf("Possibly too long UDP frame for our buffer - "
 536                        "dropping it\n");
 537                 return;
 538         }
 539
 540         msg = radius_msg_parse(buf, len);
 541         if (msg == NULL) {
 542                 printf("Parsing incoming RADIUS frame failed\n");
 543                 rconf->malformed_responses++;
 544                 return;
 545         }
 546
 547         hostapd_logger(radius->ctx, NULL, HOSTAPD_MODULE_RADIUS,
 548                        HOSTAPD_LEVEL_DEBUG, "Received RADIUS message");
 549         if (conf->msg_dumps)
 550                 radius_msg_dump(msg);
 551
 552         switch (msg->hdr->code) {
 553         case RADIUS_CODE_ACCESS_ACCEPT:
 554                 rconf->access_accepts++;
 555                 break;
 556         case RADIUS_CODE_ACCESS_REJECT:
 557                 rconf->access_rejects++;
 558                 break;
 559         case RADIUS_CODE_ACCESS_CHALLENGE:
 560                 rconf->access_challenges++;
 561                 break;
 562         case RADIUS_CODE_ACCOUNTING_RESPONSE:
 563                 rconf->responses++;
 564                 break;
 565         }
 566
 567         prev_req = NULL;
 568         req = radius->msgs;
 569         while (req) {
 570                 /* TODO: also match by src addr:port of the packet when using
 571                  * alternative RADIUS servers (?) */
 572                 if ((req->msg_type == msg_type ||
 573                      (req->msg_type == RADIUS_ACCT_INTERIM &&
 574                       msg_type == RADIUS_ACCT)) &&
 575                     req->msg->hdr->identifier == msg->hdr->identifier)
 576                         break;
 577
 578                 prev_req = req;
 579                 req = req->next;
 580         }
 581
 582         if (req == NULL) {
 583                 hostapd_logger(radius->ctx, NULL, HOSTAPD_MODULE_RADIUS,
 584                                HOSTAPD_LEVEL_DEBUG,
 585                                "No matching RADIUS request found (type=%d "
 586                                "id=%d) - dropping packet",
 587                                msg_type, msg->hdr->identifier);
 588                 goto fail;
 589         }
 590
 591         os_get_time(&now);
 592         roundtrip = (now.sec - req->last_attempt.sec) * 100 +
 593                 (now.usec - req->last_attempt.usec) / 10000;
 594         hostapd_logger(radius->ctx, req->addr, HOSTAPD_MODULE_RADIUS,
 595                        HOSTAPD_LEVEL_DEBUG,
 596                        "Received RADIUS packet matched with a pending "
 597                        "request, round trip time %d.%02d sec",
 598                        roundtrip / 100, roundtrip % 100);
 599         rconf->round_trip_time = roundtrip;
 600
 601         /* Remove ACKed RADIUS packet from retransmit list */
 602         if (prev_req)
 603                 prev_req->next = req->next;
 604         else
 605                 radius->msgs = req->next;
 606         radius->num_msgs--;
 607
 608         for (i = 0; i < num_handlers; i++) {
 609                 RadiusRxResult res;
 610                 res = handlers[i].handler(msg, req->msg, req->shared_secret,
 611                                           req->shared_secret_len,
 612                                           handlers[i].data);
 613                 switch (res) {
 614                 case RADIUS_RX_PROCESSED:
 615                         radius_msg_free(msg);
 616                         os_free(msg);
 617                         /* continue */
 618                 case RADIUS_RX_QUEUED:
 619                         radius_client_msg_free(req);
 620                         return;
 621                 case RADIUS_RX_INVALID_AUTHENTICATOR:
 622                         invalid_authenticator++;
 623                         /* continue */
 624                 case RADIUS_RX_UNKNOWN:
 625                         /* continue with next handler */
 626                         break;
 627                 }
 628         }
 629
 630         if (invalid_authenticator)
 631                 rconf->bad_authenticators++;
 632         else
 633                 rconf->unknown_types++;
 634         hostapd_logger(radius->ctx, req->addr, HOSTAPD_MODULE_RADIUS,
 635                        HOSTAPD_LEVEL_DEBUG, "No RADIUS RX handler found "
 636                        "(type=%d code=%d id=%d)%s - dropping packet",
 637                        msg_type, msg->hdr->code, msg->hdr->identifier,
 638                        invalid_authenticator ? " [INVALID AUTHENTICATOR]" :
 639                        "");
 640         radius_client_msg_free(req);
 641
 642  fail:
 643         radius_msg_free(msg);
 644         os_free(msg);
 645 }
 646
 647
 648 u8 radius_client_get_id(struct radius_client_data *radius)
 649 {
 650         struct radius_msg_list *entry, *prev, *_remove;
 651         u8 id = radius->next_radius_identifier++;
 652
 653         /* remove entries with matching id from retransmit list to avoid
 654          * using new reply from the RADIUS server with an old request */
 655         entry = radius->msgs;
 656         prev = NULL;
 657         while (entry) {
 658                 if (entry->msg->hdr->identifier == id) {
 659                         hostapd_logger(radius->ctx, entry->addr,
 660                                        HOSTAPD_MODULE_RADIUS,
 661                                        HOSTAPD_LEVEL_DEBUG,
 662                                        "Removing pending RADIUS message, "
 663                                        "since its id (%d) is reused", id);
 664                         if (prev)
 665                                 prev->next = entry->next;
 666                         else
 667                                 radius->msgs = entry->next;
 668                         _remove = entry;
 669                 } else {
 670                         _remove = NULL;
 671                         prev = entry;
 672                 }
 673                 entry = entry->next;
 674
 675                 if (_remove)
 676                         radius_client_msg_free(_remove);
 677         }
 678
 679         return id;
 680 }
 681
 682
 683 void radius_client_flush(struct radius_client_data *radius, int only_auth)
 684 {
 685         struct radius_msg_list *entry, *prev, *tmp;
 686
 687         if (!radius)
 688                 return;
 689
 690         prev = NULL;
 691         entry = radius->msgs;
 692
 693         while (entry) {
 694                 if (!only_auth || entry->msg_type == RADIUS_AUTH) {
 695                         if (prev)
 696                                 prev->next = entry->next;
 697                         else
 698                                 radius->msgs = entry->next;
 699
 700                         tmp = entry;
 701                         entry = entry->next;
 702                         radius_client_msg_free(tmp);
 703                         radius->num_msgs--;
 704                 } else {
 705                         prev = entry;
 706                         entry = entry->next;
 707                 }
 708         }
 709
 710         if (radius->msgs == NULL)
 711                 eloop_cancel_timeout(radius_client_timer, radius, NULL);
 712 }
 713
 714
 715 void radius_client_update_acct_msgs(struct radius_client_data *radius,
 716                                     u8 *shared_secret,
 717                                     size_t shared_secret_len)
 718 {
 719         struct radius_msg_list *entry;
 720
 721         if (!radius)
 722                 return;
 723
 724         for (entry = radius->msgs; entry; entry = entry->next) {
 725                 if (entry->msg_type == RADIUS_ACCT) {
 726                         entry->shared_secret = shared_secret;
 727                         entry->shared_secret_len = shared_secret_len;
 728                         radius_msg_finish_acct(entry->msg, shared_secret,
 729                                                shared_secret_len);
 730                 }
 731         }
 732 }
 733
 734
 735 static int
 736 radius_change_server(struct radius_client_data *radius,
 737                      struct hostapd_radius_server *nserv,
 738                      struct hostapd_radius_server *oserv,
 739                      int sock, int sock6, int auth)
 740 {
 741         struct sockaddr_in serv, claddr;
 742 #ifdef CONFIG_IPV6
 743         struct sockaddr_in6 serv6, claddr6;
 744 #endif /* CONFIG_IPV6 */
 745         struct sockaddr *addr;
 746         socklen_t addrlen, claddrlen;
 747         char abuf[50];
 748         int sel_sock;
 749         struct radius_msg_list *entry;
 750         struct hostapd_radius_servers *conf = radius->conf;
 751
 752         hostapd_logger(radius->ctx, NULL, HOSTAPD_MODULE_RADIUS,
 753                        HOSTAPD_LEVEL_INFO,
 754                        "%s server %s:%d",
 755                        auth ? "Authentication" : "Accounting",
 756                        hostapd_ip_txt(&nserv->addr, abuf, sizeof(abuf)),
 757                        nserv->port);
 758
 759         if (!oserv || nserv->shared_secret_len != oserv->shared_secret_len ||
 760             os_memcmp(nserv->shared_secret, oserv->shared_secret,
 761                       nserv->shared_secret_len) != 0) {
 762                 /* Pending RADIUS packets used different shared secret, so
 763                  * they need to be modified. Update accounting message
 764                  * authenticators here. Authentication messages are removed
 765                  * since they would require more changes and the new RADIUS
 766                  * server may not be prepared to receive them anyway due to
 767                  * missing state information. Client will likely retry
 768                  * authentication, so this should not be an issue. */
 769                 if (auth)
 770                         radius_client_flush(radius, 1);
 771                 else {
 772                         radius_client_update_acct_msgs(
 773                                 radius, nserv->shared_secret,
 774                                 nserv->shared_secret_len);
 775                 }
 776         }
 777
 778         /* Reset retry counters for the new server */
 779         for (entry = radius->msgs; entry; entry = entry->next) {
 780                 if ((auth && entry->msg_type != RADIUS_AUTH) ||
 781                     (!auth && entry->msg_type != RADIUS_ACCT))
 782                         continue;
 783                 entry->next_try = entry->first_try + RADIUS_CLIENT_FIRST_WAIT;
 784                 entry->attempts = 0;
 785                 entry->next_wait = RADIUS_CLIENT_FIRST_WAIT * 2;
 786         }
 787
 788         if (radius->msgs) {
 789                 eloop_cancel_timeout(radius_client_timer, radius, NULL);
 790                 eloop_register_timeout(RADIUS_CLIENT_FIRST_WAIT, 0,
 791                                        radius_client_timer, radius, NULL);
 792         }
 793
 794         switch (nserv->addr.af) {
 795         case AF_INET:
 796                 os_memset(&serv, 0, sizeof(serv));
 797                 serv.sin_family = AF_INET;
 798                 serv.sin_addr.s_addr = nserv->addr.u.v4.s_addr;
 799                 serv.sin_port = htons(nserv->port);
 800                 addr = (struct sockaddr *) &serv;
 801                 addrlen = sizeof(serv);
 802                 sel_sock = sock;
 803                 break;
 804 #ifdef CONFIG_IPV6
 805         case AF_INET6:
 806                 os_memset(&serv6, 0, sizeof(serv6));
 807                 serv6.sin6_family = AF_INET6;
 808                 os_memcpy(&serv6.sin6_addr, &nserv->addr.u.v6,
 809                           sizeof(struct in6_addr));
 810                 serv6.sin6_port = htons(nserv->port);
 811                 addr = (struct sockaddr *) &serv6;
 812                 addrlen = sizeof(serv6);
 813                 sel_sock = sock6;
 814                 break;
 815 #endif /* CONFIG_IPV6 */
 816         default:
 817                 return -1;
 818         }
 819
 820         if (conf->force_client_addr) {
 821                 switch (conf->client_addr.af) {
 822                 case AF_INET:
 823                         os_memset(&claddr, 0, sizeof(claddr));
 824                         claddr.sin_family = AF_INET;
 825                         claddr.sin_addr.s_addr = conf->client_addr.u.v4.s_addr;
 826                         claddr.sin_port = htons(0);
 827                         claddrlen = sizeof(claddr);
 828                         break;
 829 #ifdef CONFIG_IPV6
 830                 case AF_INET6:
 831                         os_memset(&claddr6, 0, sizeof(claddr6));
 832                         claddr6.sin6_family = AF_INET6;
 833                         os_memcpy(&claddr6.sin6_addr, &conf->client_addr.u.v6,
 834                                   sizeof(struct in6_addr));
 835                         claddr6.sin6_port = htons(0);
 836                         claddrlen = sizeof(claddr6);
 837                         break;
 838 #endif /* CONFIG_IPV6 */
 839                 default:
 840                         return -1;
 841                 }
 842
 843                 if (bind(sel_sock, (struct sockaddr *) &claddr, claddrlen) < 0)
 844                 {
 845                         perror("bind[radius]");
 846                         return -1;
 847                 }
 848         }
 849
 850         if (connect(sel_sock, addr, addrlen) < 0) {
 851                 perror("connect[radius]");
 852                 return -1;
 853         }
 854
 855 #ifndef CONFIG_NATIVE_WINDOWS
 856         switch (nserv->addr.af) {
 857         case AF_INET:
 858                 claddrlen = sizeof(claddr);
 859                 getsockname(sel_sock, (struct sockaddr *) &claddr, &claddrlen);
 860                 wpa_printf(MSG_DEBUG, "RADIUS local address: %s:%u",
 861                            inet_ntoa(claddr.sin_addr), ntohs(claddr.sin_port));
 862                 break;
 863 #ifdef CONFIG_IPV6
 864         case AF_INET6: {
 865                 claddrlen = sizeof(claddr6);
 866                 getsockname(sel_sock, (struct sockaddr *) &claddr6,
 867                             &claddrlen);
 868                 wpa_printf(MSG_DEBUG, "RADIUS local address: %s:%u",
 869                            inet_ntop(AF_INET6, &claddr6.sin6_addr,
 870                                      abuf, sizeof(abuf)),
 871                            ntohs(claddr6.sin6_port));
 872                 break;
 873         }
 874 #endif /* CONFIG_IPV6 */
 875         }
 876 #endif /* CONFIG_NATIVE_WINDOWS */
 877
 878         if (auth)
 879                 radius->auth_sock = sel_sock;
 880         else
 881                 radius->acct_sock = sel_sock;
 882
 883         return 0;
 884 }
 885
 886
 887 static void radius_retry_primary_timer(void *eloop_ctx, void *timeout_ctx)
 888 {
 889         struct radius_client_data *radius = eloop_ctx;
 890         struct hostapd_radius_servers *conf = radius->conf;
 891         struct hostapd_radius_server *oserv;
 892
 893         if (radius->auth_sock >= 0 && conf->auth_servers &&
 894             conf->auth_server != conf->auth_servers) {
 895                 oserv = conf->auth_server;
 896                 conf->auth_server = conf->auth_servers;
 897                 radius_change_server(radius, conf->auth_server, oserv,
 898                                      radius->auth_serv_sock,
 899                                      radius->auth_serv_sock6, 1);
 900         }
 901
 902         if (radius->acct_sock >= 0 && conf->acct_servers &&
 903             conf->acct_server != conf->acct_servers) {
 904                 oserv = conf->acct_server;
 905                 conf->acct_server = conf->acct_servers;
 906                 radius_change_server(radius, conf->acct_server, oserv,
 907                                      radius->acct_serv_sock,
 908                                      radius->acct_serv_sock6, 0);
 909         }
 910
 911         if (conf->retry_primary_interval)
 912                 eloop_register_timeout(conf->retry_primary_interval, 0,
 913                                        radius_retry_primary_timer, radius,
 914                                        NULL);
 915 }
 916
 917
 918 static int radius_client_init_auth(struct radius_client_data *radius)
 919 {
 920         struct hostapd_radius_servers *conf = radius->conf;
 921         int ok = 0;
 922
 923         radius->auth_serv_sock = socket(PF_INET, SOCK_DGRAM, 0);
 924         if (radius->auth_serv_sock < 0)
 925                 perror("socket[PF_INET,SOCK_DGRAM]");
 926         else
 927                 ok++;
 928
 929 #ifdef CONFIG_IPV6
 930         radius->auth_serv_sock6 = socket(PF_INET6, SOCK_DGRAM, 0);
 931         if (radius->auth_serv_sock6 < 0)
 932                 perror("socket[PF_INET6,SOCK_DGRAM]");
 933         else
 934                 ok++;
 935 #endif /* CONFIG_IPV6 */
 936
 937         if (ok == 0)
 938                 return -1;
 939
 940         radius_change_server(radius, conf->auth_server, NULL,
 941                              radius->auth_serv_sock, radius->auth_serv_sock6,
 942                              1);
 943
 944         if (radius->auth_serv_sock >= 0 &&
 945             eloop_register_read_sock(radius->auth_serv_sock,
 946                                      radius_client_receive, radius,
 947                                      (void *) RADIUS_AUTH)) {
 948                 printf("Could not register read socket for authentication "
 949                        "server\n");
 950                 return -1;
 951         }
 952
 953 #ifdef CONFIG_IPV6
 954         if (radius->auth_serv_sock6 >= 0 &&
 955             eloop_register_read_sock(radius->auth_serv_sock6,
 956                                      radius_client_receive, radius,
 957                                      (void *) RADIUS_AUTH)) {
 958                 printf("Could not register read socket for authentication "
 959                        "server\n");
 960                 return -1;
 961         }
 962 #endif /* CONFIG_IPV6 */
 963
 964         return 0;
 965 }
 966
 967
 968 static int radius_client_init_acct(struct radius_client_data *radius)
 969 {
 970         struct hostapd_radius_servers *conf = radius->conf;
 971         int ok = 0;
 972
 973         radius->acct_serv_sock = socket(PF_INET, SOCK_DGRAM, 0);
 974         if (radius->acct_serv_sock < 0)
 975                 perror("socket[PF_INET,SOCK_DGRAM]");
 976         else
 977                 ok++;
 978
 979 #ifdef CONFIG_IPV6
 980         radius->acct_serv_sock6 = socket(PF_INET6, SOCK_DGRAM, 0);
 981         if (radius->acct_serv_sock6 < 0)
 982                 perror("socket[PF_INET6,SOCK_DGRAM]");
 983         else
 984                 ok++;
 985 #endif /* CONFIG_IPV6 */
 986
 987         if (ok == 0)
 988                 return -1;
 989
 990         radius_change_server(radius, conf->acct_server, NULL,
 991                              radius->acct_serv_sock, radius->acct_serv_sock6,
 992                              0);
 993
 994         if (radius->acct_serv_sock >= 0 &&
 995             eloop_register_read_sock(radius->acct_serv_sock,
 996                                      radius_client_receive, radius,
 997                                      (void *) RADIUS_ACCT)) {
 998                 printf("Could not register read socket for accounting "
 999                        "server\n");
1000                 return -1;
1001         }
1002
1003 #ifdef CONFIG_IPV6
1004         if (radius->acct_serv_sock6 >= 0 &&
1005             eloop_register_read_sock(radius->acct_serv_sock6,
1006                                      radius_client_receive, radius,
1007                                      (void *) RADIUS_ACCT)) {
1008                 printf("Could not register read socket for accounting "
1009                        "server\n");
1010                 return -1;
1011         }
1012 #endif /* CONFIG_IPV6 */
1013
1014         return 0;
1015 }
1016
1017
1018 struct radius_client_data *
1019 radius_client_init(void *ctx, struct hostapd_radius_servers *conf)
1020 {
1021         struct radius_client_data *radius;
1022
1023         radius = os_zalloc(sizeof(struct radius_client_data));
1024         if (radius == NULL)
1025                 return NULL;
1026
1027         radius->ctx = ctx;
1028         radius->conf = conf;
1029         radius->auth_serv_sock = radius->acct_serv_sock =
1030                 radius->auth_serv_sock6 = radius->acct_serv_sock6 =
1031                 radius->auth_sock = radius->acct_sock = -1;
1032
1033         if (conf->auth_server && radius_client_init_auth(radius)) {
1034                 radius_client_deinit(radius);
1035                 return NULL;
1036         }
1037
1038         if (conf->acct_server && radius_client_init_acct(radius)) {
1039                 radius_client_deinit(radius);
1040                 return NULL;
1041         }
1042
1043         if (conf->retry_primary_interval)
1044                 eloop_register_timeout(conf->retry_primary_interval, 0,
1045                                        radius_retry_primary_timer, radius,
1046                                        NULL);
1047
1048         return radius;
1049 }
1050
1051
1052 void radius_client_deinit(struct radius_client_data *radius)
1053 {
1054         if (!radius)
1055                 return;
1056
1057         if (radius->auth_serv_sock >= 0)
1058                 eloop_unregister_read_sock(radius->auth_serv_sock);
1059         if (radius->acct_serv_sock >= 0)
1060                 eloop_unregister_read_sock(radius->acct_serv_sock);
1061
1062         eloop_cancel_timeout(radius_retry_primary_timer, radius, NULL);
1063
1064         radius_client_flush(radius, 0);
1065         os_free(radius->auth_handlers);
1066         os_free(radius->acct_handlers);
1067         os_free(radius);
1068 }
1069
1070
1071 void radius_client_flush_auth(struct radius_client_data *radius, u8 *addr)
1072 {
1073         struct radius_msg_list *entry, *prev, *tmp;
1074
1075         prev = NULL;
1076         entry = radius->msgs;
1077         while (entry) {
1078                 if (entry->msg_type == RADIUS_AUTH &&
1079                     os_memcmp(entry->addr, addr, ETH_ALEN) == 0) {
1080                         hostapd_logger(radius->ctx, addr,
1081                                        HOSTAPD_MODULE_RADIUS,
1082                                        HOSTAPD_LEVEL_DEBUG,
1083                                        "Removing pending RADIUS authentication"
1084                                        " message for removed client");
1085
1086                         if (prev)
1087                                 prev->next = entry->next;
1088                         else
1089                                 radius->msgs = entry->next;
1090
1091                         tmp = entry;
1092                         entry = entry->next;
1093                         radius_client_msg_free(tmp);
1094                         radius->num_msgs--;
1095                         continue;
1096                 }
1097
1098                 prev = entry;
1099                 entry = entry->next;
1100         }
1101 }
1102
1103
1104 static int radius_client_dump_auth_server(char *buf, size_t buflen,
1105                                           struct hostapd_radius_server *serv,
1106                                           struct radius_client_data *cli)
1107 {
1108         int pending = 0;
1109         struct radius_msg_list *msg;
1110         char abuf[50];
1111
1112         if (cli) {
1113                 for (msg = cli->msgs; msg; msg = msg->next) {
1114                         if (msg->msg_type == RADIUS_AUTH)
1115                                 pending++;
1116                 }
1117         }
1118
1119         return os_snprintf(buf, buflen,
1120                            "radiusAuthServerIndex=%d\n"
1121                            "radiusAuthServerAddress=%s\n"
1122                            "radiusAuthClientServerPortNumber=%d\n"
1123                            "radiusAuthClientRoundTripTime=%d\n"
1124                            "radiusAuthClientAccessRequests=%u\n"
1125                            "radiusAuthClientAccessRetransmissions=%u\n"
1126                            "radiusAuthClientAccessAccepts=%u\n"
1127                            "radiusAuthClientAccessRejects=%u\n"
1128                            "radiusAuthClientAccessChallenges=%u\n"
1129                            "radiusAuthClientMalformedAccessResponses=%u\n"
1130                            "radiusAuthClientBadAuthenticators=%u\n"
1131                            "radiusAuthClientPendingRequests=%u\n"
1132                            "radiusAuthClientTimeouts=%u\n"
1133                            "radiusAuthClientUnknownTypes=%u\n"
1134                            "radiusAuthClientPacketsDropped=%u\n",
1135                            serv->index,
1136                            hostapd_ip_txt(&serv->addr, abuf, sizeof(abuf)),
1137                            serv->port,
1138                            serv->round_trip_time,
1139                            serv->requests,
1140                            serv->retransmissions,
1141                            serv->access_accepts,
1142                            serv->access_rejects,
1143                            serv->access_challenges,
1144                            serv->malformed_responses,
1145                            serv->bad_authenticators,
1146                            pending,
1147                            serv->timeouts,
1148                            serv->unknown_types,
1149                            serv->packets_dropped);
1150 }
1151
1152
1153 static int radius_client_dump_acct_server(char *buf, size_t buflen,
1154                                           struct hostapd_radius_server *serv,
1155                                           struct radius_client_data *cli)
1156 {
1157         int pending = 0;
1158         struct radius_msg_list *msg;
1159         char abuf[50];
1160
1161         if (cli) {
1162                 for (msg = cli->msgs; msg; msg = msg->next) {
1163                         if (msg->msg_type == RADIUS_ACCT ||
1164                             msg->msg_type == RADIUS_ACCT_INTERIM)
1165                                 pending++;
1166                 }
1167         }
1168
1169         return os_snprintf(buf, buflen,
1170                            "radiusAccServerIndex=%d\n"
1171                            "radiusAccServerAddress=%s\n"
1172                            "radiusAccClientServerPortNumber=%d\n"
1173                            "radiusAccClientRoundTripTime=%d\n"
1174                            "radiusAccClientRequests=%u\n"
1175                            "radiusAccClientRetransmissions=%u\n"
1176                            "radiusAccClientResponses=%u\n"
1177                            "radiusAccClientMalformedResponses=%u\n"
1178                            "radiusAccClientBadAuthenticators=%u\n"
1179                            "radiusAccClientPendingRequests=%u\n"
1180                            "radiusAccClientTimeouts=%u\n"
1181                            "radiusAccClientUnknownTypes=%u\n"
1182                            "radiusAccClientPacketsDropped=%u\n",
1183                            serv->index,
1184                            hostapd_ip_txt(&serv->addr, abuf, sizeof(abuf)),
1185                            serv->port,
1186                            serv->round_trip_time,
1187                            serv->requests,
1188                            serv->retransmissions,
1189                            serv->responses,
1190                            serv->malformed_responses,
1191                            serv->bad_authenticators,
1192                            pending,
1193                            serv->timeouts,
1194                            serv->unknown_types,
1195                            serv->packets_dropped);
1196 }
1197
1198
1199 int radius_client_get_mib(struct radius_client_data *radius, char *buf,
1200                           size_t buflen)
1201 {
1202         struct hostapd_radius_servers *conf = radius->conf;
1203         int i;
1204         struct hostapd_radius_server *serv;
1205         int count = 0;
1206
1207         if (conf->auth_servers) {
1208                 for (i = 0; i < conf->num_auth_servers; i++) {
1209                         serv = &conf->auth_servers[i];
1210                         count += radius_client_dump_auth_server(
1211                                 buf + count, buflen - count, serv,
1212                                 serv == conf->auth_server ?
1213                                 radius : NULL);
1214                 }
1215         }
1216
1217         if (conf->acct_servers) {
1218                 for (i = 0; i < conf->num_acct_servers; i++) {
1219                         serv = &conf->acct_servers[i];
1220                         count += radius_client_dump_acct_server(
1221                                 buf + count, buflen - count, serv,
1222                                 serv == conf->acct_server ?
1223                                 radius : NULL);
1224                 }
1225         }
1226
1227         return count;
1228 }
1229
1230
1231 static int radius_servers_diff(struct hostapd_radius_server *nserv,
1232                                struct hostapd_radius_server *oserv,
1233                                int num)
1234 {
1235         int i;
1236
1237         for (i = 0; i < num; i++) {
1238                 if (hostapd_ip_diff(&nserv[i].addr, &oserv[i].addr) ||
1239                     nserv[i].port != oserv[i].port ||
1240                     nserv[i].shared_secret_len != oserv[i].shared_secret_len ||
1241                     os_memcmp(nserv[i].shared_secret, oserv[i].shared_secret,
1242                               nserv[i].shared_secret_len) != 0)
1243                         return 1;
1244         }
1245
1246         return 0;
1247 }
1248
1249
1250 struct radius_client_data *
1251 radius_client_reconfig(struct radius_client_data *old, void *ctx,
1252                        struct hostapd_radius_servers *oldconf,
1253                        struct hostapd_radius_servers *newconf)
1254 {
1255         radius_client_flush(old, 0);
1256
1257         if (newconf->retry_primary_interval !=
1258             oldconf->retry_primary_interval ||
1259             newconf->num_auth_servers != oldconf->num_auth_servers ||
1260             newconf->num_acct_servers != oldconf->num_acct_servers ||
1261             radius_servers_diff(newconf->auth_servers, oldconf->auth_servers,
1262                                 newconf->num_auth_servers) ||
1263             radius_servers_diff(newconf->acct_servers, oldconf->acct_servers,
1264                                 newconf->num_acct_servers)) {
1265                 hostapd_logger(ctx, NULL, HOSTAPD_MODULE_RADIUS,
1266                                HOSTAPD_LEVEL_DEBUG,
1267                                "Reconfiguring RADIUS client");
1268                 radius_client_deinit(old);
1269                 return radius_client_init(ctx, newconf);
1270         }
1271
1272         return old;
1273 }