]> git.ipfire.org Git - thirdparty/freeradius-server.git/commitdiff
More cleanups.
authorAlan T. DeKok <aland@freeradius.org>
Tue, 2 May 2017 20:11:28 +0000 (16:11 -0400)
committerAlan T. DeKok <aland@freeradius.org>
Tue, 2 May 2017 20:33:51 +0000 (16:33 -0400)
fr_radius_recv() -> fr_radius_packet_recv()

Move more functions out of radius.c to radius_packet.c

13 files changed:
src/include/libradius.h
src/lib/util/packet.c
src/lib/util/radius.c
src/lib/util/radius_packet.c
src/main/listen.c
src/main/radsnmp.c
src/main/tls_listen.c
src/modules/proto_radius/proto_radius_acct.c
src/modules/proto_radius/proto_radius_auth.c
src/modules/proto_radius/proto_radius_coa.c
src/modules/proto_radius/proto_radius_status.c
src/modules/rlm_eap/eap.c
src/modules/rlm_radius_client/rlm_radius_client.c

index fd46519bb412a0caa3776a73306175bff2456656..a49889fe28a54c5793a2b5013766ad66ce2e10a3 100644 (file)
@@ -212,33 +212,48 @@ do { \
 #define        FR_TUNNEL_PW_ENC_LENGTH(_x) (2 + 1 + _x + PAD(_x + 1, 16))
 extern FR_NAME_NUMBER const fr_request_types[];
 
-void           fr_radius_ascend_secret(uint8_t *digest, uint8_t const *vector, char const *secret, uint8_t const *value);
+int            fr_radius_sign(uint8_t *packet, uint8_t const *original,
+                              uint8_t const *secret, size_t secret_len) CC_HINT(nonnull (1,3));
+int            fr_radius_verify(uint8_t *packet, uint8_t const *original,
+                                uint8_t const *secret, size_t secret_len) CC_HINT(nonnull (1,3));
+bool           fr_radius_ok(uint8_t const *packet, size_t *packet_len_p, bool require_ma,
+                            decode_fail_t *reason) CC_HINT(nonnull (1,2));
 
-void           fr_radius_print_hex(RADIUS_PACKET const *packet);
-
-int            fr_radius_packet_send(RADIUS_PACKET *, RADIUS_PACKET const *, char const *secret);
-
-bool           fr_radius_packet_ok(RADIUS_PACKET *packet, bool require_ma, decode_fail_t *reason);
-
-RADIUS_PACKET  *fr_radius_recv(TALLOC_CTX *ctx, int fd, int flags, bool require_ma);
+void           fr_radius_ascend_secret(uint8_t *digest, uint8_t const *vector,
+                                       char const *secret, uint8_t const *value) CC_HINT(nonnull);
 
 ssize_t                fr_radius_recv_header(int sockfd, fr_ipaddr_t *src_ipaddr, uint16_t *src_port, unsigned int *code);
 
-int            fr_radius_packet_verify(RADIUS_PACKET *packet, RADIUS_PACKET *original, char const *secret);
-
-int            fr_radius_packet_decode(RADIUS_PACKET *packet, RADIUS_PACKET *original, char const *secret);
-
-int            fr_radius_packet_encode(RADIUS_PACKET *packet, RADIUS_PACKET const *original, char const *secret);
-
-int            fr_radius_packet_sign(RADIUS_PACKET *packet, RADIUS_PACKET const *original, char const *secret);
-
 int            fr_digest_cmp(uint8_t const *a, uint8_t const *b, size_t length);
 
+/*
+ *     radius_packet.c
+ */
 RADIUS_PACKET  *fr_radius_alloc(TALLOC_CTX *ctx, bool new_vector);
 RADIUS_PACKET  *fr_radius_alloc_reply(TALLOC_CTX *ctx, RADIUS_PACKET *);
 RADIUS_PACKET  *fr_radius_copy(TALLOC_CTX *ctx, RADIUS_PACKET const *in);
 void           fr_radius_free(RADIUS_PACKET **);
 
+int            fr_radius_packet_encode(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
+                                       char const *secret) CC_HINT(nonnull (1,3));
+int            fr_radius_packet_decode(RADIUS_PACKET *packet, RADIUS_PACKET *original,
+                                       char const *secret) CC_HINT(nonnull (1,3));
+
+bool           fr_radius_packet_ok(RADIUS_PACKET *packet, bool require_ma,
+                                   decode_fail_t *reason) CC_HINT(nonnull (1));
+
+int            fr_radius_packet_verify(RADIUS_PACKET *packet, RADIUS_PACKET *original,
+                                       char const *secret) CC_HINT(nonnull (1,3));
+int            fr_radius_packet_sign(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
+                                     char const *secret) CC_HINT(nonnull (1,3));
+
+RADIUS_PACKET  *fr_radius_packet_recv(TALLOC_CTX *ctx, int fd, int flags, bool require_ma);
+int            fr_radius_packet_send(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
+                                     char const *secret) CC_HINT(nonnull (1,3));
+
+void           fr_radius_print_hex(RADIUS_PACKET const *packet) CC_HINT(nonnull);
+
+
 typedef struct fr_radius_ctx {
        RADIUS_PACKET const     *packet;
        RADIUS_PACKET const     *original;
index 269a36ec1bac9881c63e6780eff47e0a2ecdd0a6..4b9da372cc9d0e50e9d7293e7b9580864e6b58ff 100644 (file)
@@ -914,7 +914,7 @@ RADIUS_PACKET *fr_packet_list_recv(fr_packet_list_t *pl, fd_set *set)
                        packet = fr_tcp_recv(pl->sockets[start].sockfd, false);
                } else
 #endif
-                       packet = fr_radius_recv(NULL, pl->sockets[start].sockfd, UDP_FLAGS_NONE, false);
+                       packet = fr_radius_packet_recv(NULL, pl->sockets[start].sockfd, UDP_FLAGS_NONE, false);
                if (!packet) continue;
 
                /*
index bb69a03ce9c2d6d9b8eec3f2e3c24e3e75188791..96344255d55d8cd068a67b732e2e088b92aea0ba 100644 (file)
@@ -225,8 +225,8 @@ invalid:
  *     - <0 on error
  *     - 0 on success
  */
-static int fr_radius_sign(uint8_t *packet, uint8_t const *original,
-                         uint8_t const *secret, size_t secret_len)
+int fr_radius_sign(uint8_t *packet, uint8_t const *original,
+                  uint8_t const *secret, size_t secret_len)
 {
        uint8_t *msg, *end;
        size_t packet_len = (packet[2] << 8) | packet[3];
@@ -362,38 +362,6 @@ static int fr_radius_sign(uint8_t *packet, uint8_t const *original,
        return 0;
 }
 
-/** Sign a previously encoded packet
- *
- */
-int fr_radius_packet_sign(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
-                         char const *secret)
-{
-       int rcode;
-       uint8_t const *original_data;
-
-       if (original) {
-               original_data = original->data;
-       } else {
-               original_data = NULL;
-       }
-
-       /*
-        *      Copy the random vector to the packet.  Other packet
-        *      codes have the Request Authenticator be the packet
-        *      signature.
-        */
-       if ((packet->code == PW_CODE_ACCESS_REQUEST) ||
-           (packet->code == PW_CODE_STATUS_SERVER)) {
-               memcpy(packet->data + 4, packet->vector, sizeof(packet->vector));
-       }
-
-       rcode = fr_radius_sign(packet->data, original_data,
-                              (uint8_t const *) secret, talloc_array_length(secret) - 1);
-       if (rcode < 0) return rcode;
-
-       memcpy(packet->vector, packet->data + 4, AUTH_VECTOR_LEN);
-       return 0;
-}
 
 /** Do a comparison of two authentication digests by comparing the FULL digest
  *
@@ -425,7 +393,7 @@ int fr_digest_cmp(uint8_t const *a, uint8_t const *b, size_t length)
  *     - True on success.
  *     - False on failure.
  */
-static bool fr_radius_ok(uint8_t const *packet, size_t *packet_len_p, bool require_ma, decode_fail_t *reason)
+bool fr_radius_ok(uint8_t const *packet, size_t *packet_len_p, bool require_ma, decode_fail_t *reason)
 {
        uint8_t const           *attr, *end;
        size_t                  totallen;
@@ -678,41 +646,6 @@ finish:
 }
 
 
-/** See if the data pointed to by PTR is a valid RADIUS packet.
- *
- * Packet is not 'const * const' because we may update data_len, if there's more data
- * in the UDP packet than in the RADIUS packet.
- *
- * @param packet to check
- * @param require_ma to require Message-Authenticator
- * @param reason if not NULL, will have the failure reason written to where it points.
- * @return
- *     - True on success.
- *     - False on failure.
- */
-bool fr_radius_packet_ok(RADIUS_PACKET *packet, bool require_ma, decode_fail_t *reason)
-{
-       char host_ipaddr[INET6_ADDRSTRLEN];
-
-       if (!fr_radius_ok(packet->data, &packet->data_len, require_ma, reason)) {
-               FR_DEBUG_STRERROR_PRINTF("Bad packet received from host %s - %s",
-                                        inet_ntop(packet->src_ipaddr.af,
-                                                  &packet->src_ipaddr.ipaddr,
-                                                  host_ipaddr, sizeof(host_ipaddr)),
-                                        fr_strerror());
-               return false;
-       }
-
-       /*
-        *      Fill RADIUS header fields
-        */
-       packet->code = packet->data[0];
-       packet->id = packet->data[1];
-       memcpy(packet->vector, packet->data + 4, sizeof(packet->vector));
-       return true;
-}
-
-
 /** Verify a request / response packet
  *
  *  This function does its work by calling fr_radius_sign(), and then
@@ -727,8 +660,8 @@ bool fr_radius_packet_ok(RADIUS_PACKET *packet, bool require_ma, decode_fail_t *
  *     - <0 on error
  *     - 0 on success
  */
-static int fr_radius_verify(uint8_t *packet, uint8_t const *original,
-                           uint8_t const *secret, size_t secret_len)
+int fr_radius_verify(uint8_t *packet, uint8_t const *original,
+                    uint8_t const *secret, size_t secret_len)
 {
        int rcode;
        uint8_t *msg, *end;
@@ -828,33 +761,3 @@ static int fr_radius_verify(uint8_t *packet, uint8_t const *original,
 
        return 0;
 }
-
-
-/** Verify the Request/Response Authenticator (and Message-Authenticator if present) of a packet
- *
- */
-int fr_radius_packet_verify(RADIUS_PACKET *packet, RADIUS_PACKET *original, char const *secret)
-{
-       uint8_t const   *original_data;
-       char            buffer[INET6_ADDRSTRLEN];
-
-       if (!packet || !packet->data) return -1;
-
-       if (original) {
-               original_data = original->data;
-       } else {
-               original_data = NULL;
-       }
-
-       if (fr_radius_verify(packet->data, original_data,
-                            (uint8_t const *) secret, talloc_array_length(secret) - 1) < 0) {
-               fr_strerror_printf("Received packet from %s with %s",
-                                  inet_ntop(packet->src_ipaddr.af, &packet->src_ipaddr.ipaddr,
-                                            buffer, sizeof(buffer)),
-                                  fr_strerror());
-               return -1;
-       }
-
-       return 0;
-}
-
index 52edc7786bc62fd1964fcb2503e57ac2878cb4fb..0e1278a648193e684795101f702430475ac1bb64 100644 (file)
@@ -452,6 +452,104 @@ int fr_radius_packet_decode(RADIUS_PACKET *packet, RADIUS_PACKET *original, char
 }
 
 
+/** See if the data pointed to by PTR is a valid RADIUS packet.
+ *
+ * Packet is not 'const * const' because we may update data_len, if there's more data
+ * in the UDP packet than in the RADIUS packet.
+ *
+ * @param packet to check
+ * @param require_ma to require Message-Authenticator
+ * @param reason if not NULL, will have the failure reason written to where it points.
+ * @return
+ *     - True on success.
+ *     - False on failure.
+ */
+bool fr_radius_packet_ok(RADIUS_PACKET *packet, bool require_ma, decode_fail_t *reason)
+{
+       char host_ipaddr[INET6_ADDRSTRLEN];
+
+       if (!fr_radius_ok(packet->data, &packet->data_len, require_ma, reason)) {
+               FR_DEBUG_STRERROR_PRINTF("Bad packet received from host %s - %s",
+                                        inet_ntop(packet->src_ipaddr.af,
+                                                  &packet->src_ipaddr.ipaddr,
+                                                  host_ipaddr, sizeof(host_ipaddr)),
+                                        fr_strerror());
+               return false;
+       }
+
+       /*
+        *      Fill RADIUS header fields
+        */
+       packet->code = packet->data[0];
+       packet->id = packet->data[1];
+       memcpy(packet->vector, packet->data + 4, sizeof(packet->vector));
+       return true;
+}
+
+
+/** Verify the Request/Response Authenticator (and Message-Authenticator if present) of a packet
+ *
+ */
+int fr_radius_packet_verify(RADIUS_PACKET *packet, RADIUS_PACKET *original, char const *secret)
+{
+       uint8_t const   *original_data;
+       char            buffer[INET6_ADDRSTRLEN];
+
+       if (!packet->data) return -1;
+
+       if (original) {
+               original_data = original->data;
+       } else {
+               original_data = NULL;
+       }
+
+       if (fr_radius_verify(packet->data, original_data,
+                            (uint8_t const *) secret, talloc_array_length(secret) - 1) < 0) {
+               fr_strerror_printf("Received packet from %s with %s",
+                                  inet_ntop(packet->src_ipaddr.af, &packet->src_ipaddr.ipaddr,
+                                            buffer, sizeof(buffer)),
+                                  fr_strerror());
+               return -1;
+       }
+
+       return 0;
+}
+
+
+/** Sign a previously encoded packet
+ *
+ */
+int fr_radius_packet_sign(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
+                         char const *secret)
+{
+       int rcode;
+       uint8_t const *original_data;
+
+       if (original) {
+               original_data = original->data;
+       } else {
+               original_data = NULL;
+       }
+
+       /*
+        *      Copy the random vector to the packet.  Other packet
+        *      codes have the Request Authenticator be the packet
+        *      signature.
+        */
+       if ((packet->code == PW_CODE_ACCESS_REQUEST) ||
+           (packet->code == PW_CODE_STATUS_SERVER)) {
+               memcpy(packet->data + 4, packet->vector, sizeof(packet->vector));
+       }
+
+       rcode = fr_radius_sign(packet->data, original_data,
+                              (uint8_t const *) secret, talloc_array_length(secret) - 1);
+       if (rcode < 0) return rcode;
+
+       memcpy(packet->vector, packet->data + 4, AUTH_VECTOR_LEN);
+       return 0;
+}
+
+
 /** Wrapper for recvfrom, which handles recvfromto, IPv6, and all possible combinations
  *
  */
@@ -482,7 +580,7 @@ static ssize_t rad_recvfrom(int sockfd, RADIUS_PACKET *packet, int flags)
 /** Receive UDP client requests, and fill in the basics of a RADIUS_PACKET structure
  *
  */
-RADIUS_PACKET *fr_radius_recv(TALLOC_CTX *ctx, int fd, int flags, bool require_ma)
+RADIUS_PACKET *fr_radius_packet_recv(TALLOC_CTX *ctx, int fd, int flags, bool require_ma)
 {
        ssize_t data_len;
        RADIUS_PACKET           *packet;
@@ -578,12 +676,12 @@ RADIUS_PACKET *fr_radius_recv(TALLOC_CTX *ctx, int fd, int flags, bool require_m
  * Also attach reply attribute value pairs and any user message provided.
  */
 int fr_radius_packet_send(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
-                  char const *secret)
+                         char const *secret)
 {
        /*
         *      Maybe it's a fake packet.  Don't send it.
         */
-       if (!packet || (packet->sockfd < 0)) {
+       if (packet->sockfd < 0) {
                return 0;
        }
 
index 4567bf5b7dd5ec55d529ae145f9ea3d93f4213ae..f4f59007be595f00cb51d2652ad254b44c55dc25 100644 (file)
@@ -512,7 +512,7 @@ RADCLIENT *client_listener_find(rad_listen_t *listener,
 
        request->listener = listener;
        request->client = client;
-       request->packet = fr_radius_recv(NULL, listener->fd, UDP_FLAGS_PEEK, false);
+       request->packet = fr_radius_packet_recv(NULL, listener->fd, UDP_FLAGS_PEEK, false);
        if (!request->packet) {                         /* badly formed, etc */
                talloc_free(request);
                if (DEBUG_ENABLED) ERROR("Receive - %s", fr_strerror());
@@ -1781,7 +1781,7 @@ static int stats_socket_recv(rad_listen_t *listener)
         *      Now that we've sanity checked everything, receive the
         *      packet.
         */
-       packet = fr_radius_recv(NULL, listener->fd, UDP_FLAGS_NONE, true); /* require message authenticator */
+       packet = fr_radius_packet_recv(NULL, listener->fd, UDP_FLAGS_NONE, true); /* require message authenticator */
        if (!packet) {
                FR_STATS_INC(auth, total_malformed_requests);
                if (DEBUG_ENABLED) ERROR("Receive - %s", fr_strerror());
@@ -1875,7 +1875,7 @@ static int auth_socket_recv(rad_listen_t *listener)
         *      Now that we've sanity checked everything, receive the
         *      packet.
         */
-       packet = fr_radius_recv(ctx, listener->fd, UDP_FLAGS_NONE, client->message_authenticator);
+       packet = fr_radius_packet_recv(ctx, listener->fd, UDP_FLAGS_NONE, client->message_authenticator);
        if (!packet) {
                FR_STATS_INC(auth, total_malformed_requests);
                if (DEBUG_ENABLED) ERROR("Receive - %s", fr_strerror());
@@ -1892,7 +1892,7 @@ static int auth_socket_recv(rad_listen_t *listener)
         *
         *      This hack works ONLY if the clients are global.  If
         *      each listener has the same client IP, but with
-        *      different secrets, then it will fail the fr_radius_recv()
+        *      different secrets, then it will fail the fr_radius_packet_recv()
         *      check above, and there's nothing you can do.
         */
        {
@@ -1990,7 +1990,7 @@ static int acct_socket_recv(rad_listen_t *listener)
         *      Now that we've sanity checked everything, receive the
         *      packet.
         */
-       packet = fr_radius_recv(ctx, listener->fd, UDP_FLAGS_NONE, false);
+       packet = fr_radius_packet_recv(ctx, listener->fd, UDP_FLAGS_NONE, false);
        if (!packet) {
                FR_STATS_INC(acct, total_malformed_requests);
                if (DEBUG_ENABLED) ERROR("Receive - %s", fr_strerror());
@@ -2267,7 +2267,7 @@ static int coa_socket_recv(rad_listen_t *listener)
         *      Now that we've sanity checked everything, receive the
         *      packet.
         */
-       packet = fr_radius_recv(ctx, listener->fd, UDP_FLAGS_NONE, client->message_authenticator);
+       packet = fr_radius_packet_recv(ctx, listener->fd, UDP_FLAGS_NONE, client->message_authenticator);
        if (!packet) {
                FR_STATS_INC(coa, total_malformed_requests);
                if (DEBUG_ENABLED) ERROR("Receive - %s", fr_strerror());
@@ -2298,7 +2298,7 @@ static int proxy_socket_recv(rad_listen_t *listener)
 #  endif
        char            buffer[128];
 
-       packet = fr_radius_recv(NULL, listener->fd, UDP_FLAGS_NONE, false);
+       packet = fr_radius_packet_recv(NULL, listener->fd, UDP_FLAGS_NONE, false);
        if (!packet) {
                if (DEBUG_ENABLED) ERROR("Receive - %s", fr_strerror());
                return 0;
index 727af6ae81dc5a04bb6654f87c5abfc432565c1d..befd09b8a55008a788ebb379bae33d399010ff0e 100644 (file)
@@ -799,7 +799,7 @@ static int radsnmp_send_recv(radsnmp_conf_t *conf, int fd)
                                        continue;       /* Timeout */
 
                                case 1:
-                                       reply = fr_radius_recv(request, request->sockfd, UDP_FLAGS_NONE, false);
+                                       reply = fr_radius_packet_recv(request, request->sockfd, UDP_FLAGS_NONE, false);
                                        if (!reply) {
                                                ERROR("Failed receiving reply: %s", fr_strerror());
                                        recv_error:
index e32a685b42c8fd5df1f7d22052e2d7ebea6ad971..408d322fa8b683e63cba07eeb3d2bb865577e932 100644 (file)
@@ -261,7 +261,7 @@ static int tls_socket_recv(rad_listen_t *listener)
        }
 
        /*
-        *      Copied from src/lib/radius.c, fr_radius_recv();
+        *      Copied from src/lib/radius.c, fr_radius_packet_recv();
         */
        if (fr_debug_lvl) {
                char host_ipaddr[INET6_ADDRSTRLEN];
index d8758b62558c94db5802f0c164746f8ed02faab5..7e2f10d8242f3602d6c898df00c98396e1282320 100644 (file)
@@ -288,7 +288,7 @@ static int acct_socket_recv(rad_listen_t *listener)
        }
        talloc_set_name_const(ctx, "acct_listener_pool");
 
-       packet = fr_radius_recv(ctx, listener->fd, 0, false);
+       packet = fr_radius_packet_recv(ctx, listener->fd, 0, false);
        if (!packet) {
                ERROR("%s", fr_strerror());
                talloc_free(ctx);
index 09dff876fcf4c9fe0ad864d625afc18c82d85b79..2e325eb316f29452844cfe8cd10adaee14383796 100644 (file)
@@ -927,7 +927,7 @@ static int auth_socket_recv(rad_listen_t *listener)
        }
        talloc_set_name_const(ctx, "auth_listener_pool");
 
-       packet = fr_radius_recv(ctx, listener->fd, 0, false);
+       packet = fr_radius_packet_recv(ctx, listener->fd, 0, false);
        if (!packet) {
                ERROR("%s", fr_strerror());
                talloc_free(ctx);
index e59d393bf88794ccffdca5b6ec797fafe143820b..ec2c86e701f6b91b2b1bd18e3e4830e6ba1986e4 100644 (file)
@@ -333,7 +333,7 @@ static int coa_socket_recv(rad_listen_t *listener)
        }
        talloc_set_name_const(ctx, "coa_listener_pool");
 
-       packet = fr_radius_recv(ctx, listener->fd, 0, false);
+       packet = fr_radius_packet_recv(ctx, listener->fd, 0, false);
        if (!packet) {
                ERROR("%s", fr_strerror());
                talloc_free(ctx);
index 1a60d1db73074863fb229809f3a245010234dd5e..654fc52f33ece81fbea123f82e4d9d4ac6587d24 100644 (file)
@@ -294,7 +294,7 @@ static int status_socket_recv(rad_listen_t *listener)
        }
        talloc_set_name_const(ctx, "status_listener_pool");
 
-       packet = fr_radius_recv(ctx, listener->fd, 0, false);
+       packet = fr_radius_packet_recv(ctx, listener->fd, 0, false);
        if (!packet) {
                ERROR("%s", fr_strerror());
                talloc_free(ctx);
index e7db25666bb7b7f4a447d0dbf1e3ef66ff7eba56..ccc3bdd4c2d5020ea7f4e778e5623f4ea2375eb6 100644 (file)
@@ -253,7 +253,7 @@ int eap_start(rlm_eap_t const *inst, REQUEST *request)
        /*
         *      http://www.freeradius.org/rfc/rfc2869.html#EAP-Message
         *
-        *      Checks for Message-Authenticator are handled by fr_radius_recv().
+        *      Checks for Message-Authenticator are handled by fr_radius_packet_recv().
         */
 
        /*
index 55fe9a205ba45a6a7c9a286ee706b7d823645500..54939e4299d6710c2cd838c822de426ec4b8f12c 100644 (file)
@@ -117,7 +117,7 @@ static void mod_event_fd(UNUSED fr_event_list_t *el, int fd, void *ctx)
         *      @fixme: if there's an error in the socket, remove the
         *      socket from the packet list.
         */
-       reply = fr_radius_recv(conn, fd, 0, false);
+       reply = fr_radius_packet_recv(conn, fd, 0, false);
        if (!reply) {
                return;
        }