summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--dtls.c22
-rw-r--r--radsecproxy.c361
-rw-r--r--radsecproxy.h27
-rw-r--r--tcp.c22
-rw-r--r--tls.c22
-rw-r--r--udp.c25
6 files changed, 330 insertions, 149 deletions
diff --git a/dtls.c b/dtls.c
index a80c8fd..f1a0e1e 100644
--- a/dtls.c
+++ b/dtls.c
@@ -248,7 +248,8 @@ void *dtlsserverwr(void *arg) {
}
void dtlsserverrd(struct client *client) {
- struct request rq;
+ struct request *rq;
+ uint8_t *buf;
pthread_t dtlsserverwrth;
debug(DBG_DBG, "dtlsserverrd: starting for %s", client->conf->host);
@@ -259,18 +260,25 @@ void dtlsserverrd(struct client *client) {
}
for (;;) {
- memset(&rq, 0, sizeof(struct request));
- rq.buf = raddtlsget(client->ssl, client->rbios, IDLE_TIMEOUT);
- if (!rq.buf) {
+ buf = raddtlsget(client->ssl, client->rbios, IDLE_TIMEOUT);
+ if (!buf) {
debug(DBG_ERR, "dtlsserverrd: connection from %s lost", client->conf->host);
break;
}
debug(DBG_DBG, "dtlsserverrd: got Radius message from %s", client->conf->host);
- rq.from = client;
- if (!radsrv(&rq)) {
+ rq = newrequest();
+ if (!rq) {
+ free(buf);
+ continue;
+ }
+ rq->buf = buf;
+ rq->from = client;
+ if (!radsrv(rq)) {
+ freerq(rq);
debug(DBG_ERR, "dtlsserverrd: message authentication/validation failed, closing connection from %s", client->conf->host);
break;
}
+ freerq(rq);
}
/* stop writer by setting ssl to NULL and give signal in case waiting for data */
@@ -308,7 +316,7 @@ void *dtlsservernew(void *arg) {
while (conf) {
if (verifyconfcert(cert, conf)) {
X509_free(cert);
- client = addclient(conf);
+ client = addclient(conf, 1);
if (client) {
client->sock = params->sock;
client->rbios = params->sesscache->rbios;
diff --git a/radsecproxy.c b/radsecproxy.c
index cdf9fbb..6565c75 100644
--- a/radsecproxy.c
+++ b/radsecproxy.c
@@ -32,6 +32,8 @@
/* Bugs:
* TCP accounting not yet supported
* We are not removing client requests from dynamic servers, see removeclientrqs()
+ * Need to remove UDP clients when no activity for a while...
+ * Remove expired stuff from clients request list?
*/
#include <signal.h>
@@ -88,7 +90,8 @@ int dynamicconfig(struct server *server);
int confserver_cb(struct gconffile **cf, void *arg, char *block, char *opt, char *val);
void freerealm(struct realm *realm);
void freeclsrvconf(struct clsrvconf *conf);
-void freerqdata(struct request *rq);
+void freerq(struct request *rq);
+void freerqoutdata(struct rqout *rqout);
static const struct protodefs protodefs[] = {
{ "udp", /* UDP, assuming RAD_UDP defined as 0 */
@@ -99,6 +102,7 @@ static const struct protodefs protodefs[] = {
10, /* retrycountmax */
REQUEST_RETRY_INTERVAL, /* retryintervaldefault */
60, /* retryintervalmax */
+ DUPLICATE_INTERVAL, /* duplicateintervaldefault */
udpserverrd, /* listener */
&options.sourceudp, /* srcaddrport */
NULL, /* connecter */
@@ -116,6 +120,7 @@ static const struct protodefs protodefs[] = {
0, /* retrycountmax */
REQUEST_RETRY_INTERVAL * REQUEST_RETRY_COUNT, /* retryintervaldefault */
60, /* retryintervalmax */
+ DUPLICATE_INTERVAL, /* duplicateintervaldefault */
tlslistener, /* listener */
&options.sourcetls, /* srcaddrport */
tlsconnect, /* connecter */
@@ -133,6 +138,7 @@ static const struct protodefs protodefs[] = {
0, /* retrycountmax */
REQUEST_RETRY_INTERVAL * REQUEST_RETRY_COUNT, /* retryintervaldefault */
60, /* retryintervalmax */
+ DUPLICATE_INTERVAL, /* duplicateintervaldefault */
tcplistener, /* listener */
&options.sourcetcp, /* srcaddrport */
tcpconnect, /* connecter */
@@ -150,6 +156,7 @@ static const struct protodefs protodefs[] = {
10, /* retrycountmax */
REQUEST_RETRY_INTERVAL, /* retryintervaldefault */
60, /* retryintervalmax */
+ DUPLICATE_INTERVAL, /* duplicateintervaldefault */
udpdtlsserverrd, /* listener */
&options.sourcedtls, /* srcaddrport */
dtlsconnect, /* connecter */
@@ -551,44 +558,60 @@ void freebios(struct queue *q) {
removequeue(q);
}
-struct client *addclient(struct clsrvconf *conf) {
+struct client *addclient(struct clsrvconf *conf, uint8_t lock) {
struct client *new = malloc(sizeof(struct client));
if (!new) {
debug(DBG_ERR, "malloc failed");
return NULL;
}
+
+ if (lock)
+ pthread_mutex_lock(conf->lock);
if (!conf->clients) {
conf->clients = list_create();
if (!conf->clients) {
+ if (lock)
+ pthread_mutex_unlock(conf->lock);
debug(DBG_ERR, "malloc failed");
return NULL;
}
}
memset(new, 0, sizeof(struct client));
+ pthread_mutex_init(&new->lock, NULL);
new->conf = conf;
if (conf->pdef->addclient)
conf->pdef->addclient(new);
else
new->replyq = newqueue();
list_push(conf->clients, new);
+ if (lock)
+ pthread_mutex_unlock(conf->lock);
return new;
}
void removeclient(struct client *client) {
- if (!client || !client->conf->clients)
+ if (!client)
return;
- removequeue(client->replyq);
- list_removedata(client->conf->clients, client);
- free(client->addr);
- free(client);
+
+ pthread_mutex_lock(client->conf->lock);
+ if (client->conf->clients) {
+ pthread_mutex_lock(&client->lock);
+ removequeue(client->replyq);
+ list_removedata(client->conf->clients, client);
+ pthread_mutex_unlock(&client->lock);
+ pthread_mutex_destroy(&client->lock);
+ free(client->addr);
+ free(client);
+ }
+ pthread_mutex_unlock(client->conf->lock);
}
void removeclientrqs(struct client *client) {
struct list_node *entry;
struct server *server;
- struct request *rq;
+ struct rqout *rqout;
int i;
for (entry = list_first(srvconfs); entry; entry = list_next(entry)) {
@@ -597,24 +620,26 @@ void removeclientrqs(struct client *client) {
continue;
pthread_mutex_lock(&server->newrq_mutex);
for (i = 0; i < MAX_REQUESTS; i++) {
- rq = server->requests + i;
- if (rq->from == client)
- rq->from = NULL;
+ rqout = server->requests + i;
+ if (rqout->rq && rqout->rq->from == client) {
+ freerq(rqout->rq);
+ rqout->rq = NULL;
+ }
}
pthread_mutex_unlock(&server->newrq_mutex);
}
}
void freeserver(struct server *server, uint8_t destroymutex) {
- struct request *rq, *end;
+ struct rqout *rqout, *end;
if (!server)
return;
if (server->requests) {
- rq = server->requests;
- for (end = rq + MAX_REQUESTS; rq < end; rq++)
- freerqdata(rq);
+ rqout = server->requests;
+ for (end = rqout + MAX_REQUESTS; rqout < end; rqout++)
+ freerqoutdata(rqout);
free(server->requests);
}
if (server->rbios)
@@ -661,7 +686,7 @@ int addserver(struct clsrvconf *conf) {
if (conf->pdef->addserverextra)
conf->pdef->addserverextra(conf);
- conf->servers->requests = calloc(MAX_REQUESTS, sizeof(struct request));
+ conf->servers->requests = calloc(MAX_REQUESTS, sizeof(struct rqout));
if (!conf->servers->requests) {
debug(DBG_ERR, "malloc failed");
goto errexit;
@@ -890,15 +915,36 @@ unsigned char *attrget(unsigned char *attrs, int length, uint8_t type) {
}
void freerqdata(struct request *rq) {
- if (rq->origusername)
- free(rq->origusername);
- if (rq->msg)
- radmsg_free(rq->msg);
+ if (!rq)
+ return;
if (rq->buf)
free(rq->buf);
}
-void sendrq(struct server *to, struct request *rq) {
+void freerq(struct request *rq) {
+ if (!rq)
+ return;
+ debug(DBG_DBG, "freerq: called with refcount %d", rq->refcount);
+ if (--rq->refcount)
+ return;
+ freerqdata(rq);
+ free(rq);
+}
+
+void freerqoutdata(struct rqout *rqout) {
+ if (!rqout)
+ return;
+ if (rqout->origusername)
+ free(rqout->origusername);
+ if (rqout->msg)
+ radmsg_free(rqout->msg);
+ if (rqout->buf)
+ free(rqout->buf);
+ if (rqout->rq)
+ freerq(rqout->rq);
+}
+
+void sendrq(struct server *to, struct rqout *rqout) {
int i;
pthread_mutex_lock(&to->newrq_mutex);
@@ -912,21 +958,21 @@ void sendrq(struct server *to, struct request *rq) {
break;
if (i == to->nextid) {
debug(DBG_WARN, "sendrq: no room in queue, dropping request");
- freerqdata(rq);
+ freerqoutdata(rqout);
goto exit;
}
}
- rq->msg->id = (uint8_t)i;
- rq->buf = radmsg2buf(rq->msg, (uint8_t *)to->conf->secret);
- if (!rq->buf) {
+ rqout->msg->id = (uint8_t)i;
+ rqout->buf = radmsg2buf(rqout->msg, (uint8_t *)to->conf->secret);
+ if (!rqout->buf) {
debug(DBG_ERR, "sendrq: radmsg2buf failed");
- freerqdata(rq);
+ freerqoutdata(rqout);
goto exit;
}
debug(DBG_DBG, "sendrq: inserting packet with id %d in queue for %s", i, to->conf->host);
- to->requests[i] = *rq;
+ to->requests[i] = *rqout;
to->nextid = i + 1;
if (!to->newrq) {
@@ -1254,15 +1300,15 @@ void removeserversubrealms(struct list *realmlist, struct clsrvconf *srv) {
}
int rqinqueue(struct server *to, struct client *from, uint8_t id, uint8_t code) {
- struct request *rq = to->requests, *end;
+ struct rqout *rqout = to->requests, *end;
pthread_mutex_lock(&to->newrq_mutex);
- for (end = rq + MAX_REQUESTS; rq < end; rq++)
- if (rq->buf && !rq->received && rq->origid == id && rq->from == from && *rq->buf == code)
+ for (end = rqout + MAX_REQUESTS; rqout < end; rqout++)
+ if (rqout->buf && !rqout->received && rqout->origid == id && rqout->rq && rqout->rq->from == from && *rqout->buf == code)
break;
pthread_mutex_unlock(&to->newrq_mutex);
- return rq < end;
+ return rqout < end;
}
int attrvalidate(unsigned char *attrs, int length) {
@@ -1317,7 +1363,7 @@ int msmpprecrypt(uint8_t *msmpp, uint8_t len, char *oldsecret, char *newsecret,
return 1;
}
-int msmppe(unsigned char *attrs, int length, uint8_t type, char *attrtxt, struct request *rq,
+int msmppe(unsigned char *attrs, int length, uint8_t type, char *attrtxt, struct rqout *rq,
char *oldsecret, char *newsecret) {
unsigned char *attr;
@@ -1508,14 +1554,14 @@ int dorewrite(struct radmsg *msg, struct rewrite *rewrite) {
return 1;
}
-int rewriteusername(struct request *rq, struct tlv *attr) {
+int rewriteusername(struct rqout *rqout, struct tlv *attr) {
char *orig = (char *)tlv2str(attr);
- if (!dorewritemodattr(attr, rq->from->conf->rewriteusername)) {
+ if (!dorewritemodattr(attr, rqout->rq->from->conf->rewriteusername)) {
free(orig);
return 0;
}
if (strlen(orig) != attr->l || memcmp(orig, attr->v, attr->l))
- rq->origusername = (char *)orig;
+ rqout->origusername = (char *)orig;
else
free(orig);
return 1;
@@ -1585,33 +1631,33 @@ void acclog(struct radmsg *msg, char *host) {
}
}
-void respondaccounting(struct request *rq) {
+void respondaccounting(struct rqout *rqout) {
struct radmsg *msg;
- msg = radmsg_init(RAD_Accounting_Response, rq->msg->id, rq->msg->auth);
+ msg = radmsg_init(RAD_Accounting_Response, rqout->msg->id, rqout->msg->auth);
if (msg) {
- debug(DBG_DBG, "respondaccounting: responding to %s", rq->from->conf->host);
- sendreply(rq->from, msg, &rq->fromsa, rq->fromudpsock);
+ debug(DBG_DBG, "respondaccounting: responding to %s", rqout->rq->from->conf->host);
+ sendreply(rqout->rq->from, msg, &rqout->rq->fromsa, rqout->rq->fromudpsock);
} else
debug(DBG_ERR, "respondaccounting: malloc failed");
}
-void respondstatusserver(struct request *rq) {
+void respondstatusserver(struct rqout *rqout) {
struct radmsg *msg;
- msg = radmsg_init(RAD_Access_Accept, rq->msg->id, rq->msg->auth);
+ msg = radmsg_init(RAD_Access_Accept, rqout->msg->id, rqout->msg->auth);
if (msg) {
- debug(DBG_DBG, "respondstatusserver: responding to %s", rq->from->conf->host);
- sendreply(rq->from, msg, &rq->fromsa, rq->fromudpsock);
+ debug(DBG_DBG, "respondstatusserver: responding to %s", rqout->rq->from->conf->host);
+ sendreply(rqout->rq->from, msg, &rqout->rq->fromsa, rqout->rq->fromudpsock);
} else
debug(DBG_ERR, "respondstatusserver: malloc failed");
}
-void respondreject(struct request *rq, char *message) {
+void respondreject(struct rqout *rqout, char *message) {
struct radmsg *msg;
struct tlv *attr;
- msg = radmsg_init(RAD_Access_Reject, rq->msg->id, rq->msg->auth);
+ msg = radmsg_init(RAD_Access_Reject, rqout->msg->id, rqout->msg->auth);
if (!msg) {
debug(DBG_ERR, "respondreject: malloc failed");
return;
@@ -1626,8 +1672,8 @@ void respondreject(struct request *rq, char *message) {
}
}
- debug(DBG_DBG, "respondreject: responding to %s", rq->from->conf->host);
- sendreply(rq->from, msg, &rq->fromsa, rq->fromudpsock);
+ debug(DBG_DBG, "respondreject: responding to %s", rqout->rq->from->conf->host);
+ sendreply(rqout->rq->from, msg, &rqout->rq->fromsa, rqout->rq->fromudpsock);
}
struct clsrvconf *choosesrvconf(struct list *srvconfs) {
@@ -1677,50 +1723,110 @@ struct server *findserver(struct realm **realm, struct tlv *username, uint8_t ac
return srvconf->servers;
}
+
+struct request *newrequest() {
+ struct request *rq;
+
+ rq = malloc(sizeof(struct request));
+ if (!rq) {
+ debug(DBG_ERR, "newrequest: malloc failed");
+ return NULL;
+ }
+ memset(rq, 0, sizeof(struct request));
+ rq->refcount = 1;
+ gettimeofday(&rq->created, NULL);
+ return rq;
+}
+
+int addclientrq(struct request *rq, uint8_t id) {
+ struct request *r;
+ struct timeval now;
+
+ pthread_mutex_lock(&rq->from->lock);
+ gettimeofday(&now, NULL);
+ r = rq->from->rqs[id];
+ if (r) {
+ if (r->refcount > 1 && now.tv_sec - r->created.tv_sec < r->from->conf->dupinterval) {
+ pthread_mutex_unlock(&rq->from->lock);
+ return 0;
+ }
+ freerq(r);
+ }
+ rq->refcount++;
+ rq->from->rqs[id] = rq;
+ pthread_mutex_unlock(&rq->from->lock);
+ return 1;
+}
+
+void rmclientrq(struct request *rq, uint8_t id) {
+ struct request *r;
+
+ pthread_mutex_lock(&rq->from->lock);
+ r = rq->from->rqs[id];
+ if (r) {
+ freerq(r);
+ rq->from->rqs[id] = NULL;
+ }
+ pthread_mutex_unlock(&rq->from->lock);
+}
+
/* returns 0 if validation/authentication fails, else 1 */
int radsrv(struct request *rq) {
struct radmsg *msg = NULL;
+ struct rqout *rqout, rqdata;
struct tlv *attr;
uint8_t *userascii = NULL;
unsigned char newauth[16];
struct realm *realm = NULL;
struct server *to = NULL;
-
- msg = buf2radmsg(rq->buf, (uint8_t *)rq->from->conf->secret, NULL);
+ struct client *from = rq->from;
+
+ msg = buf2radmsg(rq->buf, (uint8_t *)from->conf->secret, NULL);
if (!msg) {
debug(DBG_WARN, "radsrv: message validation failed, ignoring packet");
- freerqdata(rq);
return 0;
}
- rq->msg = msg;
+
+ rqout = &rqdata;
+ memset(rqout, 0, sizeof(struct rqout));
+ rqout->msg = msg;
debug(DBG_DBG, "radsrv: code %d, id %d", msg->code, msg->id);
if (msg->code != RAD_Access_Request && msg->code != RAD_Status_Server && msg->code != RAD_Accounting_Request) {
debug(DBG_INFO, "radsrv: server currently accepts only access-requests, accounting-requests and status-server, ignoring");
- goto exit;
+ freerqoutdata(rqout);
+ return 1;
}
+ if (!addclientrq(rq, msg->id)) {
+ debug(DBG_INFO, "radsrv: already got request with id %d from %s, ignoring", msg->id, from->conf->host);
+ freerqoutdata(rqout);
+ return 1;
+ }
+ rqout->rq = rq;
+ rq->refcount++;
+
if (msg->code == RAD_Status_Server) {
- respondstatusserver(rq);
+ respondstatusserver(rqout);
goto exit;
}
/* below: code == RAD_Access_Request || code == RAD_Accounting_Request */
- if (rq->from->conf->rewritein && !dorewrite(msg, rq->from->conf->rewritein))
+ if (from->conf->rewritein && !dorewrite(msg, from->conf->rewritein))
goto exit;
attr = radmsg_gettype(msg, RAD_Attr_User_Name);
if (!attr) {
if (msg->code == RAD_Accounting_Request) {
- acclog(msg, rq->from->conf->host);
- respondaccounting(rq);
+ acclog(msg, from->conf->host);
+ respondaccounting(rqout);
} else
debug(DBG_WARN, "radsrv: ignoring access request, no username attribute");
goto exit;
}
- if (rq->from->conf->rewriteusername && !rewriteusername(rq, attr)) {
+ if (from->conf->rewriteusername && !rewriteusername(rqout, attr)) {
debug(DBG_WARN, "radsrv: username malloc failed, ignoring request");
goto exit;
}
@@ -1737,11 +1843,11 @@ int radsrv(struct request *rq) {
}
if (!to) {
if (realm->message && msg->code == RAD_Access_Request) {
- debug(DBG_INFO, "radsrv: sending reject to %s for %s", rq->from->conf->host, userascii);
- respondreject(rq, realm->message);
+ debug(DBG_INFO, "radsrv: sending reject to %s for %s", from->conf->host, userascii);
+ respondreject(rqout, realm->message);
} else if (realm->accresp && msg->code == RAD_Accounting_Request) {
- acclog(msg, rq->from->conf->host);
- respondaccounting(rq);
+ acclog(msg, from->conf->host);
+ respondaccounting(rqout);
}
goto exit;
}
@@ -1749,17 +1855,20 @@ int radsrv(struct request *rq) {
free(rq->buf);
rq->buf = NULL;
- if (options.loopprevention && !strcmp(rq->from->conf->name, to->conf->name)) {
+ if (options.loopprevention && !strcmp(from->conf->name, to->conf->name)) {
debug(DBG_INFO, "radsrv: Loop prevented, not forwarding request from client %s to server %s, discarding",
- rq->from->conf->name, to->conf->name);
+ from->conf->name, to->conf->name);
goto exit;
}
- if (rqinqueue(to, rq->from, msg->id, msg->code)) {
+#if 0
+ skip this now that we have rqrcv... per client?
+ if (rqinqueue(to, from, msg->id, msg->code)) {
debug(DBG_INFO, "radsrv: already got %s from host %s with id %d, ignoring",
- radmsgtype2string(msg->code), rq->from->conf->host, msg->id);
+ radmsgtype2string(msg->code), from->conf->host, msg->id);
goto exit;
}
+#endif
if (msg->code != RAD_Accounting_Request) {
if (!RAND_bytes(newauth, 16)) {
@@ -1767,7 +1876,7 @@ int radsrv(struct request *rq) {
goto exit;
}
}
-
+
#ifdef DEBUG
printfchars(NULL, "auth", "%02x ", auth, 16);
#endif
@@ -1775,37 +1884,38 @@ int radsrv(struct request *rq) {
attr = radmsg_gettype(msg, RAD_Attr_User_Password);
if (attr) {
debug(DBG_DBG, "radsrv: found userpwdattr with value length %d", attr->l);
- if (!pwdrecrypt(attr->v, attr->l, rq->from->conf->secret, to->conf->secret, msg->auth, newauth))
+ if (!pwdrecrypt(attr->v, attr->l, from->conf->secret, to->conf->secret, msg->auth, newauth))
goto exit;
}
attr = radmsg_gettype(msg, RAD_Attr_Tunnel_Password);
if (attr) {
debug(DBG_DBG, "radsrv: found tunnelpwdattr with value length %d", attr->l);
- if (!pwdrecrypt(attr->v, attr->l, rq->from->conf->secret, to->conf->secret, msg->auth, newauth))
+ if (!pwdrecrypt(attr->v, attr->l, from->conf->secret, to->conf->secret, msg->auth, newauth))
goto exit;
}
- rq->origid = msg->id;
- memcpy(rq->origauth, msg->auth, 16);
+ rqout->origid = msg->id;
+ memcpy(rqout->origauth, msg->auth, 16);
memcpy(msg->auth, newauth, 16);
if (to->conf->rewriteout && !dorewrite(msg, to->conf->rewriteout))
goto exit;
free(userascii);
- sendrq(to, rq);
+ sendrq(to, rqout);
return 1;
exit:
+ rmclientrq(rq, msg->id);
free(userascii);
- freerqdata(rq);
+ freerqoutdata(rqout);
return 1;
}
void replyh(struct server *server, unsigned char *buf) {
struct client *from;
- struct request *rq;
+ struct rqout *rqout;
int sublen;
unsigned char *subattrs;
struct sockaddr_storage fromsa;
@@ -1817,8 +1927,8 @@ void replyh(struct server *server, unsigned char *buf) {
server->connectionok = 1;
server->lostrqs = 0;
- rq = server->requests + buf[1];
- msg = buf2radmsg(buf, (uint8_t *)server->conf->secret, rq->msg->auth);
+ rqout = server->requests + buf[1];
+ msg = buf2radmsg(buf, (uint8_t *)server->conf->secret, rqout->msg->auth);
free(buf);
buf = NULL;
if (!msg) {
@@ -1834,33 +1944,33 @@ void replyh(struct server *server, unsigned char *buf) {
debug(DBG_DBG, "got %s message with id %d", radmsgtype2string(msg->code), msg->id);
pthread_mutex_lock(&server->newrq_mutex);
- if (!rq->buf || !rq->tries) {
+ if (!rqout->buf || !rqout->tries) {
debug(DBG_INFO, "replyh: no matching request sent with this id, ignoring reply");
goto errunlock;
}
- if (rq->received) {
+ if (rqout->received) {
debug(DBG_INFO, "replyh: already received, ignoring reply");
goto errunlock;
}
gettimeofday(&server->lastrcv, NULL);
- if (rq->msg->code == RAD_Status_Server) {
- rq->received = 1;
+ if (rqout->msg->code == RAD_Status_Server) {
+ rqout->received = 1;
debug(DBG_DBG, "replyh: got status server response from %s", server->conf->host);
goto errunlock;
}
gettimeofday(&server->lastreply, NULL);
- from = rq->from;
- if (!from) {
+ if (!rqout->rq) {
debug(DBG_INFO, "replyh: client gone, ignoring reply");
goto errunlock;
}
+ from = rqout->rq->from;
- if (server->conf->rewritein && !dorewrite(msg, rq->from->conf->rewritein)) {
+ if (server->conf->rewritein && !dorewrite(msg, from->conf->rewritein)) {
debug(DBG_WARN, "replyh: rewritein failed");
goto errunlock;
}
@@ -1879,9 +1989,9 @@ void replyh(struct server *server, unsigned char *buf) {
subattrs = attr->v + 4;
if (!attrvalidate(subattrs, sublen) ||
!msmppe(subattrs, sublen, RAD_VS_ATTR_MS_MPPE_Send_Key, "MS MPPE Send Key",
- rq, server->conf->secret, from->conf->secret) ||
+ rqout, server->conf->secret, from->conf->secret) ||
!msmppe(subattrs, sublen, RAD_VS_ATTR_MS_MPPE_Recv_Key, "MS MPPE Recv Key",
- rq, server->conf->secret, from->conf->secret))
+ rqout, server->conf->secret, from->conf->secret))
break;
}
if (node) {
@@ -1890,9 +2000,9 @@ void replyh(struct server *server, unsigned char *buf) {
}
if (msg->code == RAD_Access_Accept || msg->code == RAD_Access_Reject || msg->code == RAD_Accounting_Response) {
- username = radattr2ascii(radmsg_gettype(rq->msg, RAD_Attr_User_Name));
+ username = radattr2ascii(radmsg_gettype(rqout->msg, RAD_Attr_User_Name));
if (username) {
- stationid = radattr2ascii(radmsg_gettype(rq->msg, RAD_Attr_Calling_Station_Id));
+ stationid = radattr2ascii(radmsg_gettype(rqout->msg, RAD_Attr_Calling_Station_Id));
if (stationid) {
debug(DBG_INFO, "%s for user %s stationid %s from %s",
radmsgtype2string(msg->code), username, stationid, server->conf->host);
@@ -1903,19 +2013,19 @@ void replyh(struct server *server, unsigned char *buf) {
}
}
- msg->id = (char)rq->origid;
- memcpy(msg->auth, rq->origauth, 16);
+ msg->id = (char)rqout->origid;
+ memcpy(msg->auth, rqout->origauth, 16);
#ifdef DEBUG
printfchars(NULL, "origauth/buf+4", "%02x ", buf + 4, 16);
#endif
- if (rq->origusername && (attr = radmsg_gettype(msg, RAD_Attr_User_Name))) {
- if (!resizeattr(attr, strlen(rq->origusername))) {
+ if (rqout->origusername && (attr = radmsg_gettype(msg, RAD_Attr_User_Name))) {
+ if (!resizeattr(attr, strlen(rqout->origusername))) {
debug(DBG_WARN, "replyh: malloc failed, ignoring reply");
goto errunlock;
}
- memcpy(attr->v, rq->origusername, strlen(rq->origusername));
+ memcpy(attr->v, rqout->origusername, strlen(rqout->origusername));
}
if (from->conf->rewriteout && !dorewrite(msg, from->conf->rewriteout)) {
@@ -1923,12 +2033,12 @@ void replyh(struct server *server, unsigned char *buf) {
goto errunlock;
}
- fromsa = rq->fromsa; /* only needed for UDP */
+ fromsa = rqout->rq->fromsa; /* only needed for UDP */
/* once we set received = 1, rq may be reused */
- rq->received = 1;
+ rqout->received = 1;
debug(DBG_INFO, "replyh: passing reply to client %s", from->conf->name);
- sendreply(from, msg, &fromsa, rq->fromudpsock);
+ sendreply(from, msg, &fromsa, rqout->rq->fromudpsock);
pthread_mutex_unlock(&server->newrq_mutex);
return;
@@ -1962,13 +2072,13 @@ struct radmsg *createstatsrvmsg() {
/* code for removing state not finished */
void *clientwr(void *arg) {
struct server *server = (struct server *)arg;
- struct request *rq;
+ struct rqout *rqout;
pthread_t clientrdth;
int i, secs, dynconffail = 0;
uint8_t rnd;
struct timeval now, laststatsrv;
struct timespec timeout;
- struct request statsrvrq;
+ struct rqout statsrvrq;
struct clsrvconf *conf;
conf = server->conf;
@@ -2045,32 +2155,32 @@ void *clientwr(void *arg) {
pthread_mutex_unlock(&server->newrq_mutex);
break;
}
- rq = server->requests + i;
+ rqout = server->requests + i;
- if (rq->received) {
+ if (rqout->received) {
debug(DBG_DBG, "clientwr: packet %d in queue is marked as received", i);
- if (rq->buf) {
+ if (rqout->buf) {
debug(DBG_DBG, "clientwr: freeing received packet %d from queue", i);
- freerqdata(rq);
+ freerqoutdata(rqout);
/* setting this to NULL means that it can be reused */
- rq->buf = NULL;
+ rqout->buf = NULL;
}
pthread_mutex_unlock(&server->newrq_mutex);
continue;
}
gettimeofday(&now, NULL);
- if (now.tv_sec < rq->expiry.tv_sec) {
- if (!timeout.tv_sec || rq->expiry.tv_sec < timeout.tv_sec)
- timeout.tv_sec = rq->expiry.tv_sec;
+ if (now.tv_sec < rqout->expiry.tv_sec) {
+ if (!timeout.tv_sec || rqout->expiry.tv_sec < timeout.tv_sec)
+ timeout.tv_sec = rqout->expiry.tv_sec;
pthread_mutex_unlock(&server->newrq_mutex);
continue;
}
- if (rq->tries == (*rq->buf == RAD_Status_Server ? 1 : conf->retrycount + 1)) {
+ if (rqout->tries == (*rqout->buf == RAD_Status_Server ? 1 : conf->retrycount + 1)) {
debug(DBG_DBG, "clientwr: removing expired packet from queue");
if (conf->statusserver) {
- if (*rq->buf == RAD_Status_Server) {
+ if (*rqout->buf == RAD_Status_Server) {
debug(DBG_WARN, "clientwr: no status server response, %s dead?", conf->host);
if (server->lostrqs < 255)
server->lostrqs++;
@@ -2080,18 +2190,18 @@ void *clientwr(void *arg) {
if (server->lostrqs < 255)
server->lostrqs++;
}
- freerqdata(rq);
+ freerqoutdata(rqout);
/* setting this to NULL means that it can be reused */
- rq->buf = NULL;
+ rqout->buf = NULL;
pthread_mutex_unlock(&server->newrq_mutex);
continue;
}
pthread_mutex_unlock(&server->newrq_mutex);
- rq->expiry.tv_sec = now.tv_sec + conf->retryinterval;
- if (!timeout.tv_sec || rq->expiry.tv_sec < timeout.tv_sec)
- timeout.tv_sec = rq->expiry.tv_sec;
- rq->tries++;
+ rqout->expiry.tv_sec = now.tv_sec + conf->retryinterval;
+ if (!timeout.tv_sec || rqout->expiry.tv_sec < timeout.tv_sec)
+ timeout.tv_sec = rqout->expiry.tv_sec;
+ rqout->tries++;
conf->pdef->clientradput(server, server->requests[i].buf);
}
if (conf->statusserver) {
@@ -2099,7 +2209,7 @@ void *clientwr(void *arg) {
gettimeofday(&now, NULL);
if (now.tv_sec - secs > STATUS_SERVER_PERIOD) {
laststatsrv = now;
- memset(&statsrvrq, 0, sizeof(struct request));
+ memset(&statsrvrq, 0, sizeof(struct rqout));
statsrvrq.msg = createstatsrvmsg();
if (statsrvrq.msg) {
debug(DBG_DBG, "clientwr: sending status server to %s", conf->host);
@@ -2885,6 +2995,10 @@ void freeclsrvconf(struct clsrvconf *conf) {
free(conf->rewriteout);
if (conf->addrinfo)
freeaddrinfo(conf->addrinfo);
+ if (conf->lock) {
+ pthread_mutex_destroy(conf->lock);
+ free(conf->lock);
+ }
/* not touching ssl_ctx, clients and servers */
free(conf);
}
@@ -2934,11 +3048,12 @@ int mergesrvconf(struct clsrvconf *dst, struct clsrvconf *src) {
int confclient_cb(struct gconffile **cf, void *arg, char *block, char *opt, char *val) {
struct clsrvconf *conf;
char *conftype = NULL, *rewriteinalias = NULL;
+ long int dupinterval = LONG_MIN;
debug(DBG_DBG, "confclient_cb called for %s", block);
conf = malloc(sizeof(struct clsrvconf));
- if (!conf || !list_push(clconfs, conf))
+ if (!conf)
debugx(1, DBG_ERR, "malloc failed");
memset(conf, 0, sizeof(struct clsrvconf));
conf->certnamecheck = 1;
@@ -2950,6 +3065,7 @@ int confclient_cb(struct gconffile **cf, void *arg, char *block, char *opt, char
"tls", CONF_STR, &conf->tls,
"matchcertificateattribute", CONF_STR, &conf->matchcertattr,
"CertificateNameCheck", CONF_BLN, &conf->certnamecheck,
+ "DuplicateInterval", CONF_LINT, &dupinterval,
"rewrite", CONF_STR, &rewriteinalias,
"rewriteIn", CONF_STR, &conf->confrewritein,
"rewriteOut", CONF_STR, &conf->confrewriteout,
@@ -2979,7 +3095,14 @@ int confclient_cb(struct gconffile **cf, void *arg, char *block, char *opt, char
if (conf->matchcertattr && !addmatchcertattr(conf))
debugx(1, DBG_ERR, "error in block %s, invalid MatchCertificateAttributeValue", block);
}
-
+
+ if (dupinterval != LONG_MIN) {
+ if (dupinterval < 0 || dupinterval > 255)
+ debugx(1, DBG_ERR, "error in block %s, value of option DuplicateInterval is %d, must be 0-255", block, dupinterval);
+ conf->dupinterval = (uint8_t)dupinterval;
+ } else
+ conf->dupinterval = conf->pdef->duplicateintervaldefault;
+
if (!conf->confrewritein)
conf->confrewritein = rewriteinalias;
else
@@ -3004,6 +3127,14 @@ int confclient_cb(struct gconffile **cf, void *arg, char *block, char *opt, char
if (!conf->secret)
debugx(1, DBG_ERR, "malloc failed");
}
+
+ conf->lock = malloc(sizeof(pthread_mutex_t));
+ if (!conf->lock)
+ debugx(1, DBG_ERR, "malloc failed");
+
+ pthread_mutex_init(conf->lock, NULL);
+ if (!list_push(clconfs, conf))
+ debugx(1, DBG_ERR, "malloc failed");
return 1;
}
diff --git a/radsecproxy.h b/radsecproxy.h
index d37967f..00a185d 100644
--- a/radsecproxy.h
+++ b/radsecproxy.h
@@ -17,6 +17,7 @@
#define MAX_REQUESTS 256
#define REQUEST_RETRY_INTERVAL 5
#define REQUEST_RETRY_COUNT 2
+#define DUPLICATE_INTERVAL REQUEST_RETRY_INTERVAL * REQUEST_RETRY_COUNT
#define MAX_CERT_DEPTH 5
#define STATUS_SERVER_PERIOD 25
#define IDLE_TIMEOUT 300
@@ -41,19 +42,26 @@ struct options {
uint8_t loopprevention;
};
-/* requests that our client will send */
struct request {
+ struct timeval created;
+ uint8_t refcount;
+ uint8_t *buf;
+ struct client *from;
+ struct sockaddr_storage fromsa; /* used by udpservwr */
+ int fromudpsock; /* used by udpservwr */
+};
+
+/* requests that our client will send */
+struct rqout {
unsigned char *buf;
struct radmsg *msg;
uint8_t tries;
uint8_t received;
struct timeval expiry;
- struct client *from;
char *origusername;
uint8_t origid; /* used by servwr */
char origauth[16]; /* used by servwr */
- struct sockaddr_storage fromsa; /* used by udpservwr */
- int fromudpsock; /* used by udpservwr */
+ struct request *rq;
};
/* replies that a server will send */
@@ -88,12 +96,14 @@ struct clsrvconf {
uint8_t statusserver;
uint8_t retryinterval;
uint8_t retrycount;
+ uint8_t dupinterval;
uint8_t certnamecheck;
SSL_CTX *ssl_ctx;
struct rewrite *rewritein;
struct rewrite *rewriteout;
struct addrinfo *addrinfo;
uint8_t prefixlen;
+ pthread_mutex_t *lock; /* only used for updating clients so far */
struct list *clients;
struct server *servers;
};
@@ -102,6 +112,8 @@ struct client {
struct clsrvconf *conf;
int sock; /* for tcp/dtls */
SSL *ssl;
+ pthread_mutex_t lock; /* used for updating rqs */
+ struct request *rqs[MAX_REQUESTS];
struct queue *replyq;
struct queue *rbios; /* for dtls */
struct sockaddr *addr; /* for udp */
@@ -121,7 +133,7 @@ struct server {
char *dynamiclookuparg;
int nextid;
struct timeval lastrcv;
- struct request *requests;
+ struct rqout *requests;
uint8_t newrq;
pthread_mutex_t newrq_mutex;
pthread_cond_t newrq_cond;
@@ -173,6 +185,7 @@ struct protodefs {
uint8_t retrycountmax;
uint8_t retryintervaldefault;
uint8_t retryintervalmax;
+ uint8_t duplicateintervaldefault;
void *(*listener)(void*);
char **srcaddrport;
int (*connecter)(struct server *, struct timeval *, int, char *);
@@ -198,12 +211,14 @@ struct addrinfo *getsrcprotores(uint8_t type);
struct clsrvconf *find_clconf(uint8_t type, struct sockaddr *addr, struct list_node **cur);
struct clsrvconf *find_srvconf(uint8_t type, struct sockaddr *addr, struct list_node **cur);
struct clsrvconf *find_clconf_type(uint8_t type, struct list_node **cur);
-struct client *addclient(struct clsrvconf *conf);
+struct client *addclient(struct clsrvconf *conf, uint8_t lock);
void removeclient(struct client *client);
void removeclientrqs(struct client *client);
struct queue *newqueue();
void removequeue(struct queue *q);
void freebios(struct queue *q);
+struct request *newrequest();
+void freerq(struct request *rq);
int radsrv(struct request *rq);
X509 *verifytlscert(SSL *ssl);
int verifyconfcert(X509 *cert, struct clsrvconf *conf);
diff --git a/tcp.c b/tcp.c
index a470120..b3e41df 100644
--- a/tcp.c
+++ b/tcp.c
@@ -223,7 +223,8 @@ void *tcpserverwr(void *arg) {
}
void tcpserverrd(struct client *client) {
- struct request rq;
+ struct request *rq;
+ uint8_t *buf;
pthread_t tcpserverwrth;
debug(DBG_DBG, "tcpserverrd: starting for %s", client->conf->host);
@@ -234,18 +235,25 @@ void tcpserverrd(struct client *client) {
}
for (;;) {
- memset(&rq, 0, sizeof(struct request));
- rq.buf = radtcpget(client->sock, 0);
- if (!rq.buf) {
+ buf = radtcpget(client->sock, 0);
+ if (!buf) {
debug(DBG_ERR, "tcpserverrd: connection from %s lost", client->conf->host);
break;
}
debug(DBG_DBG, "tcpserverrd: got Radius message from %s", client->conf->host);
- rq.from = client;
- if (!radsrv(&rq)) {
+ rq = newrequest();
+ if (!rq) {
+ free(buf);
+ continue;
+ }
+ rq->buf = buf;
+ rq->from = client;
+ if (!radsrv(rq)) {
+ freerq(rq);
debug(DBG_ERR, "tcpserverrd: message authentication/validation failed, closing connection from %s", client->conf->host);
break;
}
+ freerq(rq);
}
/* stop writer by setting s to -1 and give signal in case waiting for data */
@@ -275,7 +283,7 @@ void *tcpservernew(void *arg) {
conf = find_clconf(RAD_TCP, (struct sockaddr *)&from, NULL);
if (conf) {
- client = addclient(conf);
+ client = addclient(conf, 1);
if (client) {
client->sock = s;
tcpserverrd(client);
diff --git a/tls.c b/tls.c
index 4a9641f..6836c28 100644
--- a/tls.c
+++ b/tls.c
@@ -276,7 +276,8 @@ void *tlsserverwr(void *arg) {
}
void tlsserverrd(struct client *client) {
- struct request rq;
+ struct request *rq;
+ uint8_t *buf;
pthread_t tlsserverwrth;
debug(DBG_DBG, "tlsserverrd: starting for %s", client->conf->host);
@@ -287,18 +288,25 @@ void tlsserverrd(struct client *client) {
}
for (;;) {
- memset(&rq, 0, sizeof(struct request));
- rq.buf = radtlsget(client->ssl, 0);
- if (!rq.buf) {
+ buf = radtlsget(client->ssl, 0);
+ if (!buf) {
debug(DBG_ERR, "tlsserverrd: connection from %s lost", client->conf->host);
break;
}
debug(DBG_DBG, "tlsserverrd: got Radius message from %s", client->conf->host);
- rq.from = client;
- if (!radsrv(&rq)) {
+ rq = newrequest();
+ if (!rq) {
+ free(buf);
+ continue;
+ }
+ rq->buf = buf;
+ rq->from = client;
+ if (!radsrv(rq)) {
+ freerq(rq);
debug(DBG_ERR, "tlsserverrd: message authentication/validation failed, closing connection from %s", client->conf->host);
break;
}
+ freerq(rq);
}
/* stop writer by setting ssl to NULL and give signal in case waiting for data */
@@ -349,7 +357,7 @@ void *tlsservernew(void *arg) {
while (conf) {
if (verifyconfcert(cert, conf)) {
X509_free(cert);
- client = addclient(conf);
+ client = addclient(conf, 1);
if (client) {
client->ssl = ssl;
tlsserverrd(client);
diff --git a/udp.c b/udp.c
index 4d27425..3079a68 100644
--- a/udp.c
+++ b/udp.c
@@ -102,22 +102,28 @@ unsigned char *radudpget(int s, struct client **client, struct server **server,
debug(DBG_DBG, "radudpget: packet was padded with %d bytes", cnt - len);
if (client) {
+ pthread_mutex_lock(p->lock);
for (node = list_first(p->clients); node; node = list_next(node))
if (addr_equal((struct sockaddr *)&from, ((struct client *)node->data)->addr))
break;
if (node) {
*client = (struct client *)node->data;
+ pthread_mutex_unlock(p->lock);
break;
}
fromcopy = addr_copy((struct sockaddr *)&from);
- if (!fromcopy)
+ if (!fromcopy) {
+ pthread_mutex_unlock(p->lock);
continue;
- *client = addclient(p);
+ }
+ *client = addclient(p, 0);
if (!*client) {
free(fromcopy);
+ pthread_mutex_unlock(p->lock);
continue;
}
(*client)->addr = fromcopy;
+ pthread_mutex_unlock(p->lock);
} else if (server)
*server = p->servers;
break;
@@ -178,14 +184,19 @@ void *udpclientrd(void *arg) {
}
void *udpserverrd(void *arg) {
- struct request rq;
+ struct request *rq;
int *sp = (int *)arg;
for (;;) {
- memset(&rq, 0, sizeof(struct request));
- rq.buf = radudpget(*sp, &rq.from, NULL, &rq.fromsa);
- rq.fromudpsock = *sp;
- radsrv(&rq);
+ rq = newrequest();
+ if (!rq) {
+ sleep(5); /* malloc failed */
+ continue;
+ }
+ rq->buf = radudpget(*sp, &rq->from, NULL, &rq->fromsa);
+ rq->fromudpsock = *sp;
+ radsrv(rq);
+ freerq(rq);
}
free(sp);
}