Date: Thu, 6 Dec 2012 19:00:37 +0000 (UTC) From: Sergey Matveychuk <sem@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r243956 - head/lib/libradius Message-ID: <201212061900.qB6J0baZ015329@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: sem (ports committer) Date: Thu Dec 6 19:00:37 2012 New Revision: 243956 URL: http://svnweb.freebsd.org/changeset/base/243956 Log: - Rewrite radius servers traversal algorithm. - Add functions for working with IPv6 attributes. Approved by: ae Modified: head/lib/libradius/Makefile head/lib/libradius/libradius.3 head/lib/libradius/radius.conf.5 head/lib/libradius/radlib.c head/lib/libradius/radlib.h head/lib/libradius/radlib_private.h head/lib/libradius/radlib_vs.h Modified: head/lib/libradius/Makefile ============================================================================== --- head/lib/libradius/Makefile Thu Dec 6 18:51:18 2012 (r243955) +++ head/lib/libradius/Makefile Thu Dec 6 19:00:37 2012 (r243956) @@ -35,6 +35,7 @@ MAN= libradius.3 radius.conf.5 MLINKS+=libradius.3 rad_acct_open.3 \ libradius.3 rad_add_server.3 \ + libradius.3 rad_add_server_ex.3 \ libradius.3 rad_auth_open.3 \ libradius.3 rad_bind_to.3 \ libradius.3 rad_close.3 \ Modified: head/lib/libradius/libradius.3 ============================================================================== --- head/lib/libradius/libradius.3 Thu Dec 6 18:51:18 2012 (r243955) +++ head/lib/libradius/libradius.3 Thu Dec 6 19:00:37 2012 (r243956) @@ -37,6 +37,8 @@ .Fn rad_acct_open "void" .Ft int .Fn rad_add_server "struct rad_handle *h" "const char *host" "int port" "const char *secret" "int timeout" "int max_tries" +.Ft int +.Fn rad_add_server_ex "struct rad_handle *h" "const char *host" "int port" "const char *secret" "int timeout" "int max_tries" "int dead_time" "struct in_addr bindto" .Ft "struct rad_handle *" .Fn rad_auth_open "void" .Ft void @@ -153,7 +155,12 @@ is used. returns 0 on success, or \-1 if an error occurs. .Pp The library can also be configured programmatically by calls to -.Fn rad_add_server . +.Fn rad_add_server +or +.Fn rad_add_server_ex . +.Fn rad_add_server +is a backward compatible function, implemented via +.Fn rad_add_server_ex . The .Fa host parameter specifies the server host, either as a fully qualified @@ -188,11 +195,20 @@ The maximum number of repeated requests to make before giving up is passed into the .Fa max_tries parameter. +Time interval in seconds when the server will not be requested +if it is marked as dead (did not answer on the last try) set with +.Fa dead_time +parameter. +.Fa bindto +parameter is an IP address on the multihomed host that is used as +a source address for all requests. .Fn rad_add_server returns 0 on success, or \-1 if an error occurs. .Pp .Fn rad_add_server -may be called multiple times, and it may be used together with +or +.Fn rad_add_server_ex +may be called multiple times, and they may be used together with .Fn rad_config . At most 10 servers may be specified. When multiple servers are given, they are tried in round-robin Modified: head/lib/libradius/radius.conf.5 ============================================================================== --- head/lib/libradius/radius.conf.5 Thu Dec 6 18:51:18 2012 (r243955) +++ head/lib/libradius/radius.conf.5 Thu Dec 6 19:00:37 2012 (r243956) @@ -44,7 +44,7 @@ Leading white space is ignored, as are empty lines and lines containing only comments. .Pp -A RADIUS server is described by three to five fields on a line: +A RADIUS server is described by three to seven fields on a line: .Pp .Bl -item -offset indent -compact .It @@ -57,6 +57,10 @@ Shared secret Timeout .It Retries +.It +Dead time +.It +Bind address .El .Pp The fields are separated by white space. @@ -139,6 +143,13 @@ If omitted, it defaults to 3 attempts. Note, this is the total number of attempts and not the number of retries. .Pp +The sixth field contains a decimal integer specifying a time interval +in seconds when the server will not requested if it was inaccessible +on the last try. 0 means ask always. +.Pp +The seventh field contains an IP address on multihomed host. All +requests will be binded to this IP. +.Pp Up to 10 RADIUS servers may be specified for each service type. The servers are tried in round-robin fashion, until a valid response is received or the @@ -161,6 +172,9 @@ acct radius1.domain.com OurLittleSecre # timeout and maximum tries: auth auth.domain.com:1645 "I can't see you" 5 4 +# As above but set dead time and bind address +auth auth.domain.com:1645 "I can't see you" 5 4 60 192.168.1.8 + # A server specified by its IP address: auth 192.168.27.81 $X*#..38947ax-+= .Ed Modified: head/lib/libradius/radlib.c ============================================================================== --- head/lib/libradius/radlib.c Thu Dec 6 18:51:18 2012 (r243955) +++ head/lib/libradius/radlib.c Thu Dec 6 19:00:37 2012 (r243956) @@ -43,6 +43,8 @@ __FBSDID("$FreeBSD$"); #include <md5.h> #endif +#define MAX_FIELDS 7 + /* We need the MPPE_KEY_LEN define */ #include <netgraph/ng_mppc.h> @@ -379,6 +381,18 @@ int rad_add_server(struct rad_handle *h, const char *host, int port, const char *secret, int timeout, int tries) { + struct in_addr bindto; + bindto.s_addr = INADDR_ANY; + + return rad_add_server_ex(h, host, port, secret, timeout, tries, + DEAD_TIME, &bindto); +} + +int +rad_add_server_ex(struct rad_handle *h, const char *host, int port, + const char *secret, int timeout, int tries, int dead_time, + struct in_addr *bindto) +{ struct rad_server *srvp; if (h->num_servers >= MAXSERVERS) { @@ -421,6 +435,10 @@ rad_add_server(struct rad_handle *h, con srvp->timeout = timeout; srvp->max_tries = tries; srvp->num_tries = 0; + srvp->is_dead = 0; + srvp->dead_time = dead_time; + srvp->next_probe = 0; + srvp->bindto = bindto->s_addr; h->num_servers++; return 0; } @@ -441,6 +459,13 @@ rad_close(struct rad_handle *h) free(h); } +void +rad_bind_to(struct rad_handle *h, in_addr_t addr) +{ + + h->bindto = addr; +} + int rad_config(struct rad_handle *h, const char *path) { @@ -468,11 +493,15 @@ rad_config(struct rad_handle *h, const c char *secret; char *timeout_str; char *maxtries_str; + char *dead_time_str; + char *bindto_str; char *end; char *wanttype; unsigned long timeout; unsigned long maxtries; + unsigned long dead_time; int port; + struct in_addr bindto; int i; linenum++; @@ -491,7 +520,7 @@ rad_config(struct rad_handle *h, const c buf[len - 1] = '\0'; /* Extract the fields from the line. */ - nfields = split(buf, fields, 5, msg, sizeof msg); + nfields = split(buf, fields, MAX_FIELDS, msg, sizeof msg); if (nfields == -1) { generr(h, "%s:%d: %s", path, linenum, msg); retval = -1; @@ -507,7 +536,7 @@ rad_config(struct rad_handle *h, const c */ if (strcmp(fields[0], "auth") != 0 && strcmp(fields[0], "acct") != 0) { - if (nfields >= 5) { + if (nfields >= MAX_FIELDS) { generr(h, "%s:%d: invalid service type", path, linenum); retval = -1; @@ -529,6 +558,8 @@ rad_config(struct rad_handle *h, const c secret = fields[2]; timeout_str = fields[3]; maxtries_str = fields[4]; + dead_time_str = fields[5]; + bindto_str = fields[6]; /* Ignore the line if it is for the wrong service type. */ wanttype = h->type == RADIUS_AUTH ? "auth" : "acct"; @@ -570,8 +601,30 @@ rad_config(struct rad_handle *h, const c } else maxtries = MAXTRIES; - if (rad_add_server(h, host, port, secret, timeout, maxtries) == - -1) { + if (dead_time_str != NULL) { + dead_time = strtoul(dead_time_str, &end, 10); + if (*end != '\0') { + generr(h, "%s:%d: invalid dead_time", path, + linenum); + retval = -1; + break; + } + } else + dead_time = DEAD_TIME; + + if (bindto_str != NULL) { + bindto.s_addr = inet_addr(bindto_str); + if (bindto.s_addr == INADDR_NONE) { + generr(h, "%s:%d: invalid bindto", path, + linenum); + retval = -1; + break; + } + } else + bindto.s_addr = INADDR_ANY; + + if (rad_add_server_ex(h, host, port, secret, timeout, maxtries, + dead_time, &bindto) == -1) { strcpy(msg, h->errmsg); generr(h, "%s:%d: %s", path, linenum, msg); retval = -1; @@ -596,7 +649,9 @@ int rad_continue_send_request(struct rad_handle *h, int selected, int *fd, struct timeval *tv) { - int n; + int n, cur_srv; + time_t now; + struct sockaddr_in sin; if (h->type == RADIUS_SERVER) { generr(h, "denied function call"); @@ -621,19 +676,61 @@ rad_continue_send_request(struct rad_han } } - if (h->try == h->total_tries) { - generr(h, "No valid RADIUS responses received"); - return -1; - } - /* * Scan round-robin to the next server that has some * tries left. There is guaranteed to be one, or we * would have exited this loop by now. */ - while (h->servers[h->srv].num_tries >= h->servers[h->srv].max_tries) - if (++h->srv >= h->num_servers) - h->srv = 0; + cur_srv = h->srv; + now = time(NULL); + if (h->servers[h->srv].num_tries >= h->servers[h->srv].max_tries) { + /* Set next probe time for this server */ + if (h->servers[h->srv].dead_time) { + h->servers[h->srv].is_dead = 1; + h->servers[h->srv].next_probe = now + + h->servers[h->srv].dead_time; + } + do { + h->srv++; + if (h->srv >= h->num_servers) + h->srv = 0; + if (h->servers[h->srv].is_dead == 0) + break; + if (h->servers[h->srv].dead_time && + h->servers[h->srv].next_probe <= now) { + h->servers[h->srv].is_dead = 0; + h->servers[h->srv].num_tries = 0; + break; + } + } while (h->srv != cur_srv); + + if (h->srv == cur_srv) { + generr(h, "No valid RADIUS responses received"); + return (-1); + } + } + + /* Rebind */ + if (h->bindto != h->servers[h->srv].bindto) { + h->bindto = h->servers[h->srv].bindto; + close(h->fd); + if ((h->fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP)) == -1) { + generr(h, "Cannot create socket: %s", strerror(errno)); + return -1; + } + memset(&sin, 0, sizeof sin); + sin.sin_len = sizeof sin; + sin.sin_family = AF_INET; + sin.sin_addr.s_addr = h->bindto; + sin.sin_port = 0; + if (bind(h->fd, (const struct sockaddr *)&sin, + sizeof sin) == -1) { + generr(h, "bind: %s", strerror(errno)); + close(h->fd); + h->fd = -1; + return (-1); + } + } if (h->out[POS_CODE] == RAD_ACCESS_REQUEST) { /* Insert the scrambled password into the request */ @@ -641,9 +738,11 @@ rad_continue_send_request(struct rad_han insert_scrambled_password(h, h->srv); } insert_message_authenticator(h, 0); + if (h->out[POS_CODE] != RAD_ACCESS_REQUEST) { /* Insert the request authenticator into the request */ - insert_request_authenticator(h, h->srv); + memset(&h->out[POS_AUTH], 0, LEN_AUTH); + insert_request_authenticator(h, 0); } /* Send the request */ @@ -654,7 +753,6 @@ rad_continue_send_request(struct rad_han tv->tv_sec = 1; /* Do not wait full timeout if send failed. */ else tv->tv_sec = h->servers[h->srv].timeout; - h->try++; h->servers[h->srv].num_tries++; tv->tv_usec = 0; *fd = h->fd; @@ -740,6 +838,10 @@ rad_create_request(struct rad_handle *h, generr(h, "denied function call"); return (-1); } + if (h->num_servers == 0) { + generr(h, "No RADIUS servers specified"); + return (-1); + } h->out[POS_CODE] = code; h->out[POS_IDENT] = ++h->ident; if (code == RAD_ACCESS_REQUEST) { @@ -756,16 +858,9 @@ rad_create_request(struct rad_handle *h, clear_password(h); h->authentic_pos = 0; h->out_created = 1; - h->bindto = INADDR_ANY; return 0; } -void -rad_bind_to(struct rad_handle *h, in_addr_t addr) -{ - h->bindto = addr; -} - int rad_create_response(struct rad_handle *h, int code) { @@ -793,6 +888,15 @@ rad_cvt_addr(const void *data) return value; } +struct in6_addr +rad_cvt_addr6(const void *data) +{ + struct in6_addr value; + + memcpy(&value.s6_addr, data, sizeof value.s6_addr); + return value; +} + u_int32_t rad_cvt_int(const void *data) { @@ -848,6 +952,8 @@ int rad_init_send_request(struct rad_handle *h, int *fd, struct timeval *tv) { int srv; + time_t now; + struct sockaddr_in sin; if (h->type == RADIUS_SERVER) { generr(h, "denied function call"); @@ -855,8 +961,6 @@ rad_init_send_request(struct rad_handle } /* Make sure we have a socket to use */ if (h->fd == -1) { - struct sockaddr_in sin; - if ((h->fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP)) == -1) { generr(h, "Cannot create socket: %s", strerror(errno)); return -1; @@ -902,21 +1006,30 @@ rad_init_send_request(struct rad_handle h->out[POS_LENGTH] = h->out_len >> 8; h->out[POS_LENGTH+1] = h->out_len; - /* - * Count the total number of tries we will make, and zero the - * counter for each server. - */ - h->total_tries = 0; - for (srv = 0; srv < h->num_servers; srv++) { - h->total_tries += h->servers[srv].max_tries; + h->srv = 0; + now = time(NULL); + for (srv = 0; srv < h->num_servers; srv++) h->servers[srv].num_tries = 0; - } - if (h->total_tries == 0) { - generr(h, "No RADIUS servers specified"); - return -1; + /* Find a first good server. */ + for (srv = 0; srv < h->num_servers; srv++) { + if (h->servers[srv].is_dead == 0) + break; + if (h->servers[srv].dead_time && + h->servers[srv].next_probe <= now) { + h->servers[srv].is_dead = 0; + break; + } + h->srv++; } - h->try = h->srv = 0; + /* If all servers was dead on the last probe, try from beginning */ + if (h->srv == h->num_servers) { + for (srv = 0; srv < h->num_servers; srv++) { + h->servers[srv].is_dead = 0; + h->servers[srv].next_probe = 0; + } + h->srv = 0; + } return rad_continue_send_request(h, 0, fd, tv); } @@ -946,6 +1059,7 @@ rad_auth_open(void) h->type = RADIUS_AUTH; h->out_created = 0; h->eap_msg = 0; + h->bindto = INADDR_ANY; } return h; } @@ -987,6 +1101,13 @@ rad_put_addr(struct rad_handle *h, int t } int +rad_put_addr6(struct rad_handle *h, int type, struct in6_addr addr) +{ + + return rad_put_attr(h, type, &addr.s6_addr, sizeof addr.s6_addr); +} + +int rad_put_attr(struct rad_handle *h, int type, const void *value, size_t len) { int result; @@ -1229,6 +1350,15 @@ rad_put_vendor_addr(struct rad_handle *h } int +rad_put_vendor_addr6(struct rad_handle *h, int vendor, int type, + struct in6_addr addr) +{ + + return (rad_put_vendor_attr(h, vendor, type, &addr.s6_addr, + sizeof addr.s6_addr)); +} + +int rad_put_vendor_attr(struct rad_handle *h, int vendor, int type, const void *value, size_t len) { Modified: head/lib/libradius/radlib.h ============================================================================== --- head/lib/libradius/radlib.h Thu Dec 6 18:51:18 2012 (r243955) +++ head/lib/libradius/radlib.h Thu Dec 6 19:00:37 2012 (r243956) @@ -194,6 +194,9 @@ __BEGIN_DECLS struct rad_handle *rad_acct_open(void); int rad_add_server(struct rad_handle *, const char *, int, const char *, int, int); +int rad_add_server_ex(struct rad_handle *, + const char *, int, const char *, int, int, + int, struct in_addr *); struct rad_handle *rad_auth_open(void); void rad_bind_to(struct rad_handle *, in_addr_t); void rad_close(struct rad_handle *); @@ -203,6 +206,7 @@ int rad_continue_send_request(struct int rad_create_request(struct rad_handle *, int); int rad_create_response(struct rad_handle *, int); struct in_addr rad_cvt_addr(const void *); +struct in6_addr rad_cvt_addr6(const void *); u_int32_t rad_cvt_int(const void *); char *rad_cvt_string(const void *, size_t); int rad_get_attr(struct rad_handle *, const void **, @@ -211,6 +215,7 @@ int rad_init_send_request(struct rad_ struct timeval *); struct rad_handle *rad_open(void); /* Deprecated, == rad_auth_open */ int rad_put_addr(struct rad_handle *, int, struct in_addr); +int rad_put_addr6(struct rad_handle *, int, struct in6_addr); int rad_put_attr(struct rad_handle *, int, const void *, size_t); int rad_put_int(struct rad_handle *, int, u_int32_t); Modified: head/lib/libradius/radlib_private.h ============================================================================== --- head/lib/libradius/radlib_private.h Thu Dec 6 18:51:18 2012 (r243955) +++ head/lib/libradius/radlib_private.h Thu Dec 6 19:00:37 2012 (r243956) @@ -46,6 +46,7 @@ #define RADIUS_PORT 1812 #define RADACCT_PORT 1813 #define TIMEOUT 3 /* In seconds */ +#define DEAD_TIME 0 /* Limits */ #define ERRSIZE 128 /* Maximum error message length */ @@ -68,6 +69,10 @@ struct rad_server { int timeout; /* Timeout in seconds */ int max_tries; /* Number of tries before giving up */ int num_tries; /* Number of tries so far */ + int is_dead; /* The server did not answer last time */ + time_t dead_time; /* Don't try this server for the time period if it is dead */ + time_t next_probe; /* Time of a next probe after failure */ + in_addr_t bindto; /* Bind to address */ }; struct rad_handle { @@ -88,11 +93,9 @@ struct rad_handle { unsigned char in[MSGSIZE]; /* Response received */ int in_len; /* Length of response */ int in_pos; /* Current position scanning attrs */ - int total_tries; /* How many requests we'll send */ - int try; /* How many requests we've sent */ int srv; /* Server number we did last */ int type; /* Handle type */ - in_addr_t bindto; /* Bind to address */ + in_addr_t bindto; /* Current bind address */ }; struct vendor_attribute { Modified: head/lib/libradius/radlib_vs.h ============================================================================== --- head/lib/libradius/radlib_vs.h Thu Dec 6 18:51:18 2012 (r243955) +++ head/lib/libradius/radlib_vs.h Thu Dec 6 19:00:37 2012 (r243956) @@ -73,6 +73,7 @@ struct rad_handle; __BEGIN_DECLS int rad_get_vendor_attr(u_int32_t *, const void **, size_t *); int rad_put_vendor_addr(struct rad_handle *, int, int, struct in_addr); +int rad_put_vendor_addr6(struct rad_handle *, int, int, struct in6_addr); int rad_put_vendor_attr(struct rad_handle *, int, int, const void *, size_t); int rad_put_vendor_int(struct rad_handle *, int, int, u_int32_t);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201212061900.qB6J0baZ015329>