Detect RADIUS packet retransmissions

diff --git a/src/libcharon/plugins/tnc_pdp/tnc_pdp.c b/src/libcharon/plugins/tnc_pdp/tnc_pdp.c
index 89237f564ef6cf7c9b522c6006ba9f75d602a2b7..109c216d5a0e8a0aad5a9e196047b6260fdf7d4e 100644 (file)
--- a/src/libcharon/plugins/tnc_pdp/tnc_pdp.c
+++ b/src/libcharon/plugins/tnc_pdp/tnc_pdp.c
@@ -18,6 +18,7 @@
 
 #include <errno.h>
 #include <unistd.h>
+#include <time.h>
 
 #include <radius_message.h>
 #include <radius_mppe.h>
@@ -37,7 +38,7 @@
 #include <sa/eap/eap_method.h>
 
 typedef struct private_tnc_pdp_t private_tnc_pdp_t;
-
+typedef struct client_entry_t client_entry_t;
 /**
  * Default RADIUS port, when not configured
  */
@@ -48,6 +49,8 @@ typedef struct private_tnc_pdp_t private_tnc_pdp_t;
  */
 #define MAX_PACKET 4096
 
+#define RADIUS_RETRANSMIT_TIMEOUT      30 /* seconds */
+
 /**
  * private data of tnc_pdp_t
  */
@@ -98,6 +101,11 @@ struct private_tnc_pdp_t {
         */
        chunk_t secret;
 
+       /**
+        * RADIUS clients
+        */
+       linked_list_t *clients;
+
        /**
         * MD5 hasher
         */
@@ -120,6 +128,33 @@ struct private_tnc_pdp_t {
 
 };
 
+/**
+ * Client entry helping to detect RADIUS packet retransmissions
+ */
+struct client_entry_t {
+
+       /**
+        * IP host address and port of client
+        */
+       host_t *host;
+
+       /**
+        * Time of last RADIUS Access-Request received from client
+        */
+       time_t last_time;
+
+       /**
+        * Identifier of last RADIUS Access-Request received from client
+        */
+       uint8_t last_id;
+};
+
+static void free_client_entry(client_entry_t *this)
+{
+       this->host->destroy(this->host);
+       free(this);
+}
+
 /**
  * Open IPv4 or IPv6 UDP socket
  */
@@ -663,16 +698,24 @@ static bool radius_receive(private_tnc_pdp_t *this, int fd, watcher_event_t even
 {
        radius_message_t *request;
        char buffer[MAX_PACKET];
+       client_entry_t *client;
+       bool retransmission = FALSE, found = FALSE, stale;
+       enumerator_t *enumerator;
        int bytes_read = 0;
        host_t *source;
+       uint8_t id;
+       time_t now;
+
        union {
                struct sockaddr_in in4;
                struct sockaddr_in6 in6;
        } src;
+
        struct iovec iov = {
                .iov_base = buffer,
                .iov_len = MAX_PACKET,
        };
+
        struct msghdr msg = {
                .msg_name = &src,
                .msg_namelen = sizeof(src),
@@ -704,7 +747,46 @@ static bool radius_receive(private_tnc_pdp_t *this, int fd, watcher_event_t even
                if (request->verify(request, NULL, this->secret, this->hasher,
                                                                                   this->signer))
                {
-                       process_eap(this, request, source);
+                       id = request->get_identifier(request);
+                       now = time(NULL);
+
+                       enumerator = this->clients->create_enumerator(this->clients);
+                       while (enumerator->enumerate(enumerator, &client))
+                       {
+                               stale = client->last_time < now - RADIUS_RETRANSMIT_TIMEOUT;
+
+                               if (source->equals(source, client->host))
+                               {
+                                       retransmission = !stale && client->last_id == id;
+                                       client->last_id = id;
+                                       client->last_time = now;
+                                       found = TRUE;
+                               }
+                               else if (stale)
+                               {
+                                       this->clients->remove_at(this->clients, enumerator);
+                                       free_client_entry(client);
+                               }
+                       }
+                       enumerator->destroy(enumerator);
+
+                       if (!found)
+                       {
+                               client = malloc_thing(client_entry_t);
+                               client->host = source->clone(source);
+                               client->last_id = id;
+                               client->last_time = now;
+                               this->clients->insert_last(this->clients, client);
+                       }
+                       if (retransmission)
+                       {
+                               DBG1(DBG_CFG, "ignoring RADIUS Access-Request 0x%02x, "
+                                                         "already processing", id);
+                       }
+                       else
+                       {
+                               process_eap(this, request, source);
+                       }
                }
                request->destroy(request);
        }
@@ -739,6 +821,10 @@ METHOD(tnc_pdp_t, destroy, void,
                lib->watcher->remove(lib->watcher, this->radius_ipv6);
                close(this->radius_ipv6);
        }
+       if (this->clients)
+       {
+               this->clients->destroy_function(this->clients, (void*)free_client_entry);
+       }
        DESTROY_IF(this->server);
        DESTROY_IF(this->signer);
        DESTROY_IF(this->hasher);
@@ -843,6 +929,7 @@ tnc_pdp_t *tnc_pdp_create(void)
                this->radius_ipv4 = open_udp_socket(AF_INET,  radius_port);
                this->radius_ipv6 = open_udp_socket(AF_INET6, radius_port);
                this->secret = chunk_from_str(secret);
+               this->clients = linked_list_create();
                this->type = eap_type_from_string(eap_type_str);
                this->hasher = lib->crypto->create_hasher(lib->crypto, HASH_MD5);
                this->signer = lib->crypto->create_signer(lib->crypto, AUTH_HMAC_MD5_128);