path: root/src/radius/radius_client.c
Commit message (Collapse)AuthorAgeFilesLines
* RADIUS client: Support SO_BINDTODEVICEBen Greear2021-02-271-5/+24
| | | | | | | | Allow the RADIUS client socket to be bound to a specific netdev. This helps hostapd work better in VRF and other fancy network environments. Signed-off-by: Ben Greear <greearb@candelatech.com> Signed-off-by: Andreas Tobler <andreas.tobler at onway.ch>
* Check for message truncation in RADIUS clientAnusha Datar2021-02-191-4/+13
| | | | | | | | | | | | | | | The RADIUS client currently determines if a radius message is longer than the supported maximum length by checking whether the size of the received buffer and the length of the buffer (as returned by recv()) is equal. This method fails to detect if the buffer has actually been truncated. This change modifies the RADIUS client to instead use the recvmsg() call and then check the message header flags to determine whether or not the received message has been truncated and drop the message if that is the case. Signed-off-by: Anusha Datar <anusha@meter.com> Reviewed-by: Steve deRosier <derosier@cal-sierra.com> Reviewed-by: Julian Squires <julian@cipht.net>
* Create RADIUS_MAX_MSG_LEN param in the shared radius.hAnusha Datar2021-02-191-1/+1
| | | | | | | | | | | | | | | The RADIUS client currently uses a hardcoded value of 3000 for the maximum length of a RADIUS message, and the RADIUS server currently defines a constant value for the maximum length of the RADIUS message within its source. The client and the server should use the same maximum length value, so this change creates a shared parameter RADIUS_MAX_MSG_LEN within the header file radius.h and modifies both the client and the server to use that parameter instead of a locally set value. Signed-off-by: Anusha Datar <anusha@meter.com> Reviewed-by: Steve deRosier <derosier@cal-sierra.com> Reviewed-by: Julian Squires <julian@cipht.net>
* RADIUS client: fix extra retry before failoverEthan Everett2019-12-301-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | This commit changes the failover behavior of RADIUS client. Commit 27ebadccfb2 ("RADIUS client: Cease endless retry for message for multiple servers") changed the retry logic, causing RADIUS client to wait RADIUS_CLIENT_NUM_FAILOVER + 1 timeouts before failing over the first time. Prior to that commit, RADIUS client would wait RADIUS_CLIENT_NUM_FAILOVER timeouts before each failover. This was caused by moving the entry->attempts > RADIUS_CLIENT_NUM_FAILOVER comparison to before the retry attempt, where entry->attempts is incremented. The commit in question set entry->attempts in radius_change_server to 1 instead of 0, so RADIUS client would still only wait RADIUS_CLIENT_NUM_FAILOVER timeouts for subsequent failovers, the same as the original behavior. This commit changes the comparison so the initial failover now happens after waiting RADIUS_CLIENT_NUM_FAILOVER timeouts, as it did originally. It also changes the RADIUS_CLIENT_MAX_FAILOVER comparison to prevent an additional attempt to the primary server after the final failover. Signed-off-by: Ethan Everett <ethan.everett@meraki.net>
* RADIUS client: Cease endless retry for message for multiple serversBo Chen2019-01-071-32/+54
| | | | | | | | | | | | | | | | | | In the previous RADIUS client implementation, when there are multiple RADIUS servers, we kept trying the next server when the current message can not be acked. It leads to endless retry when all the RADIUS servers are down. Fix this by keeping a counter for the accumulated retransmit attempts for the message, and guarantee that after all the servers failover RADIUS_CLIENT_MAX_FAILOVER times the message will be dropped. Another issue with the previous code was that the decision regarding whether the server should fail over was made immediately after we send out the message. This patch guarantees we consider whether a server needs failover after pending ack times out. Signed-off-by: Bo Chen<bochen@meraki.com>
* Silence new gcc warnings on switch statement fallthroughsJouni Malinen2018-05-151-2/+2
| | | | | | | Reword the comments to make gcc 8.1 recognize these as designed cases and not trigger implicit-fallthrough warnings. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
* radius: Sanity check for NULL pointer segfaultEduardo Abinader2016-08-191-1/+6
| | | | | | | When the RADIUS client has not yet been fully enabled, MIB command was segfaulting hostapd. Signed-off-by: Eduardo Abinader <eduardoabinader@gmail.com>
* RADIUS: Add Acct-Delay-Time into accounting messagesJouni Malinen2016-02-291-0/+30
| | | | | | | | | | | | | | | | | | This tells to the server how long we have been trying to transmit the message so that the actual time of the message generation can be determined from receive time (ignoring network delays and only at accuracy of one second). For interim updates, only value 0 is used since there are no retransmissions of the same message. For other accounting messages, the initial attempt goes out with value 0 and the retransmissions, if needed, show the number of seconds the message has been waiting in the queue. Update the Identifier and Authenticator in the messages whenever updating the Acct-Delay-Time per RFC 2866, 4.1 requirements. Signed-off-by: Jouni Malinen <j@w1.fi>
* RADIUS: Update full message for interim accounting updatesJouni Malinen2016-02-291-43/+49
| | | | | | | | | | | | Instead of using the RADIUS client retransmission design with the old RADIUS message contents for each retry, trigger a completely new interim accounting update instance more quickly (using the same schedule as RADIUS message retransmissions) to improve accounting updates in cases where RADIUS message delivery fails. This allows the server to get up to date information from the time the "retry" message was sent instead of the old information from the time the first failed attempt was sent. Signed-off-by: Jouni Malinen <j@w1.fi>
* RADIUS: Add EACCES to list of recognized send() errno valuesJouni Malinen2015-12-241-1/+1
| | | | | | | | | | | | | This allows RADIUS failover to be performed if send() return EACCES error which is what happens after a recent Linux kernel commit 0315e382704817b279e5693dca8ab9d89aa20b3f ('net: Fix behaviour of unreachable, blackhole and prohibit') for a local sender when route type is prohibit. This fixes the hwsim test case radius_failover when running against a kernel build that includes that commit. Signed-off-by: Jouni Malinen <j@w1.fi>
* hostapd: Force RADIUS socket renewal on RADIUS auth failuresHelmut Schaa2015-10-051-3/+16
| | | | | | | | | | | | On RADIUS auth/acct failures hostapd will try a new server if one is available. Reuse the failover logic to force a socket renewal if only one RADIUS server is configured. This fixes problems when a route for the RADIUS server gets added after the socket was "connected". The RADIUS socket is still sending the RADIUS requests out using the previous route. Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
* RADIUS client: Fix server failover on return-to-primary on error caseJouni Malinen2015-03-011-6/+16
| | | | | | | If a connection with the primary server cannot be established, restore connection to the previously used server. Signed-off-by: Jouni Malinen <j@w1.fi>
* RADIUS client: Fix a copy-paste error in accounting server failoverJouni Malinen2015-03-011-1/+1
| | | | | | | | | | Commit 347c55e216f22002246e378097a16ecb24b7c106 ('RADIUS client: Re-try connection if socket is closed on retransmit') added a new option for initialing RADIUS server failover from radius_client_retransmit(), but ended up trying to change authentication servers when accounting server was supposed to be changed due to a copy-paste issue. Signed-off-by: Jouni Malinen <j@w1.fi>
* RADIUS client: Fix previous failover changeJouni Malinen2015-02-281-2/+11
| | | | | | | | | | | | | Commit 347c55e216f22002246e378097a16ecb24b7c106 ('RADIUS client: Re-try connection if socket is closed on retransmit') added a possibility of executing RADIUS server failover change within radius_client_retransmit() without taking into account that this operation may end up freeing the pending message that is being processed. This could result in use of freed memory. Avoid this by checking whether any pending messages have been removed and if so, do not try to retransmit the potentially freed message. Signed-off-by: Jouni Malinen <j@w1.fi>
* RADIUS client: Re-try connection if socket is closed on retransmitJouni Malinen2015-02-281-45/+75
| | | | | | | | | | | | | Previously, send() was called with invalid fd = -1 in some error cases for retransmission and this could even result in a loop of multiple such attempts. This is obviously not going to work, so drop such attempts and instead, try to reconnect a socket to the server if the current socket is not valid. In addition, initiate server failover immediately if the current socket is not valid instead of waiting for a timeout. Signed-off-by: Jouni Malinen <j@w1.fi>
* RADIUS client: Fix server connection recovery after initial failureJouni Malinen2015-02-281-0/+6
| | | | | | | | | | | | | | | | If the initial attempt at opening the socket connection to the RADIUS server failed due to missing IP connectivity during startup, e.g., with "connect[radius]: Network is unreachable", hostapd did not try to reconnect when RADIUS messages were sent. Instead, it only reported "No authentication server configured" even if the configuration did have a server entry. This was broken by commit 9ed40766735a9628cc6c936076b175e6f66534bb ('RADIUS client: Do not try to send message without socket') for the initial case and the more recent fixes in RADIUS server failover cases did not cover the initial failure case. Signed-off-by: Jouni Malinen <j@w1.fi>
* Fix RADIUS client with out-of-memory and missing shared secretJouni Malinen2015-01-191-2/+4
| | | | | | | It was possible for an out-of-memory code path to trigger NULL pointer dereference when preparing a RADIUS accounting report. Signed-off-by: Jouni Malinen <j@w1.fi>
* RADIUS client: Print a clear debug log entry if socket is not availableJouni Malinen2014-11-231-0/+7
| | | | | | | | | | It could have been possible to select a socket that is not open (sel_sock == -1) and try to use that in socket operations. This would fail with potentially confusing error messages. Make this clearer by printing a clear debug log entry on socket not being available. (CID 72696) Signed-off-by: Jouni Malinen <j@w1.fi>
* RADIUS client: Check getsockname() return valueJouni Malinen2014-09-071-9/+13
| | | | | | | In theory, this function could fail, so check the return value before printing out the RADIUS local address debug message (CID 72700). Signed-off-by: Jouni Malinen <j@w1.fi>
* RADIUS client: Trigger failover more quickly if socket is not validJouni Malinen2014-05-301-1/+5
| | | | | | | | | | It is possible for the connect() call to fail (e.g., due to unreachable network based on local routing table), so the current auth/acct_sock may be left to -1. Use that as an addition trigger to allow server failover operation to be performed more quickly if it is known that the retransmission attempt will not succeed anyway. Signed-off-by: Jouni Malinen <j@w1.fi>
* RADIUS client: Do not flush pending messages if server did not changeJouni Malinen2014-05-301-4/+6
| | | | | | | | | | The re-open socket to the current RADIUS server code path did not work in the expected way here. The pending authentication messages do not need to be flushed in that case and neither should the retransmission parameters be cleared. Fix this by performing these operations only if the server did actually change as a part of a failover operation. Signed-off-by: Jouni Malinen <j@w1.fi>
* RADIUS client: Fix socket close/re-open on server changeJouni Malinen2014-05-301-12/+48
| | | | | | | | | Both IPv4 and IPv6 sockets were not closed consistently in the paths that tried to change RADIUS servers. This could result in leaking sockets and leaving behind registered eloop events to freed memory on interface removal. Signed-off-by: Jouni Malinen <j@w1.fi>
* RADIUS client: Fix crash issue in radius_client_timer()Jerry Yang2014-05-301-6/+29
| | | | | | | | | | While iterating through RADIUS messages in radius_client_timer(), one message entry may get flushed by "radius_client_retransmit --> radius_client_handle_send_error --> radius_client_init_auth --> radius_change_server --> radius_client_flush". This could result in freed memory being accessed afterwards. Signed-off-by: Jerry Yang <xyang@sonicwall.com>
* RADIUS client: Handle ENETUNREACH similarly to other failure casesJouni Malinen2014-05-301-1/+1
| | | | | | | This is one more possible send() error that should trigger RADIUS server change if multiple servers are configured. Signed-off-by: Jouni Malinen <j@w1.fi>
* RADIUS client: Do not try to send message without socketJouni Malinen2014-05-301-2/+2
| | | | | | | | | | | It is possible for the RADIUS authentication/accounting socket to not be open even if partial RADIUS server configuration has been done through the control interface SET commands. Previously, this resulted in send() attempt using fd=-1 which fails with bad file descriptor. Clean this up by logging this as a missing configuration instead of trying to send the message when that is known to fail. Signed-off-by: Jouni Malinen <j@w1.fi>
* RADIUS client: Use monotonic timeJohannes Berg2013-12-241-9/+9
| | | | | | | Since the RADIUS client cares about relative time (retry timeout) only, it should use monotonic time. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
* Convert perror/printf calls to wpa_printfJouni Malinen2013-11-021-26/+24
| | | | | | | This makes debug and error logging more consistent and allows them to be directed to a file more easily. Signed-hostap: Jouni Malinen <j@w1.fi>
* Convert os_realloc() for an array to use os_realloc_array()Jouni Malinen2012-08-131-2/+2
| | | | Signed-hostap: Jouni Malinen <j@w1.fi>
* Remove extra linefeed from hostapd_logger messageJouni Malinen2012-04-011-1/+1
| | | | Signed-hostap: Jouni Malinen <j@w1.fi>
* Fix potential double free and use of freed memory in RADIUS clientAlexander Couzens2012-04-011-1/+1
| | | | | | | | | | ieee802_1x_encapsulate_radius() frees the RADIUS message if radius_client_send() returns error. This could have resulted in use of freed memory and double freeing of the RADIUS message if send() fails since the message is also left in the retransmit list. Avoid this by not returning error to the caller in such a case. Signed-off-by: Alexander Couzens <lynxis@c-base.org>
* Remove the GPL notification from files contributed by Jouni MalinenJouni Malinen2012-02-111-8/+2
| | | | | | | Remove the GPL notification text from the files that were initially contributed by myself. Signed-hostap: Jouni Malinen <j@w1.fi>
* hostapd: Fix RADIUS client configuration update on reconfigJouni Malinen2011-02-101-0/+8
| | | | | | | The internal pointer to RADIUS client configuration needs to be updated whenever a new hostapd configuration is loaded. Without this, freed memory may be dereferenced and this can result in segmentation faults.
* Fix RADIUS client to cancel IPv6 socket read notificationsJouni Malinen2009-12-191-0/+6
* Make struct radius_msg private to radius.cJouni Malinen2009-12-191-9/+15
| | | | | This is internal data structure for RADIUS message handling and external code should not touch it directly.
* Convert RADIUS message code to use wpabuf internallyJouni Malinen2009-12-191-2/+3
* Change radius_msg_free() to free the bufferJouni Malinen2009-12-191-5/+0
| | | | | Since all callers were freeing the buffer immediately anyway, move this operation into radius_msg_free() to reduce code size.
* Complete Doxygen documentation for RADIUS clientJouni Malinen2009-11-291-11/+93
| | | | | No more warnings from Doxygen about missing documentation from radius_client.[ch].
* Remove unused RADIUS client reconfig functionJouni Malinen2009-11-281-62/+0
| | | | | | | | | | | | | This is not actually used at all and it looks like the rules for maintaining the old/new RADIUS configuration are not very clear in the case the RADIUS client configuration did not change. Consequently, it is better to just remove this for now and if similar functionality is ever needed, redesign it to be easier to use without causing hard to find issues with using freed memory. Simpler approach to reconfiguring the RADIUS client would involve just deinitializing the old context unconditionally and initializing a new one whenever the configuration could have changed.
* Improved Doxygen documentation for RADIUS client codeJouni Malinen2009-11-281-18/+186
* Disable PMTU discovery for RADIUS packets (sent them without DF)Stefan Winter2009-08-231-2/+22
| | | | | | | | | | | When Linux has Path MTU discovery enabled, it sets by default the DF bit on all outgoing datagrams, also UDP ones. If a RADIUS message is bigger than the smallest MTU size to the target, it will be discarded. This effectively limits RADIUS messages to ~ 1500 Bytes, while they can be up to 4k according to RFC2865. In practice, this can mean trouble when doing EAP-TLS with many RADIUS attributes besides the EAP-Message. [Bug 326]
* Mark shared secret const in RADIUS client routinesJouni Malinen2009-01-081-2/+3
* Mark functions static if not used elsewhere and use proper prototypesJouni Malinen2009-01-031-3/+3
* Fixed RADIUS client local address forcing for IPv6 (eapol_test)Jouni Malinen2008-06-051-3/+4
| | | | Need to use the IPv6 address data in bind() call if IPv6 is selected.
* eapol_test: Allow client IP address to be specifiedTomasz Wolniewicz2008-03-301-3/+57
| | | | | | | | | | | | | Allow the user to set the IP address of the eapol_test client. This if very useful when you have a machine with many interfaces and want to use a particular one for testing RADIUS connectivity. For instance when I run the national eduroam proxy I can only connect to other server from a particular address, an our machine happens to have several IPs. So if I want to run connectivity tests, I must make sure that my test uses a particular interface. The -A option allows one to set this). (jm: cleaned up to use radius configuration structure instead of global variable for the address and added IPv6 support)
* Re-initialize hostapd/wpa_supplicant git repository based on 0.6.3 releaseJouni Malinen2008-02-281-0/+1219