lots of changes to radsrv/reply and use of new radmsg stuff

git-svn-id: https://svn.testnett.uninett.no/radsecproxy/trunk@373 e88ac4ed-0b26-0410-9574-a7f39faa03bf

1 files changed, 267 insertions, 387 deletions

diff --git a/radsecproxy.c b/radsecproxy.c
index 48543ef..ef27a11 100644
--- a/radsecproxy.c
+++ b/radsecproxy.c
@@ -62,6 +62,8 @@
 #include "debug.h"
 #include "list.h"
 #include "hash.h"
+#include "tlv11.h"
+#include "radmsg.h"
 #include "util.h"
 #include "gconfig.h"
 #include "radsecproxy.h"
@@ -900,70 +902,6 @@ int radsign(unsigned char *rad, unsigned char *sec) {
     return result;
 }
 
-int validauth(unsigned char *rad, unsigned char *reqauth, unsigned char *sec) {
-    static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
-    static unsigned char first = 1;
-    static EVP_MD_CTX mdctx;
-    unsigned char hash[EVP_MAX_MD_SIZE];
-    unsigned int len;
-    int result;
-    
-    pthread_mutex_lock(&lock);
-    if (first) {
-	EVP_MD_CTX_init(&mdctx);
-	first = 0;
-    }
-
-    len = RADLEN(rad);
-    
-    result = (EVP_DigestInit_ex(&mdctx, EVP_md5(), NULL) &&
-	      EVP_DigestUpdate(&mdctx, rad, 4) &&
-	      EVP_DigestUpdate(&mdctx, reqauth, 16) &&
-	      (len <= 20 || EVP_DigestUpdate(&mdctx, rad + 20, len - 20)) &&
-	      EVP_DigestUpdate(&mdctx, sec, strlen((char *)sec)) &&
-	      EVP_DigestFinal_ex(&mdctx, hash, &len) &&
-	      len == 16 &&
-	      !memcmp(hash, rad + 4, 16));
-    pthread_mutex_unlock(&lock);
-    return result;
-}
-	      
-int checkmessageauth(unsigned char *rad, uint8_t *authattr, char *secret) {
-    static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
-    static unsigned char first = 1;
-    static HMAC_CTX hmacctx;
-    unsigned int md_len;
-    uint8_t auth[16], hash[EVP_MAX_MD_SIZE];
-    
-    pthread_mutex_lock(&lock);
-    if (first) {
-	HMAC_CTX_init(&hmacctx);
-	first = 0;
-    }
-
-    memcpy(auth, authattr, 16);
-    memset(authattr, 0, 16);
-    md_len = 0;
-    HMAC_Init_ex(&hmacctx, secret, strlen(secret), EVP_md5(), NULL);
-    HMAC_Update(&hmacctx, rad, RADLEN(rad));
-    HMAC_Final(&hmacctx, hash, &md_len);
-    memcpy(authattr, auth, 16);
-    if (md_len != 16) {
-	debug(DBG_WARN, "message auth computation failed");
-	pthread_mutex_unlock(&lock);
-	return 0;
-    }
-
-    if (memcmp(auth, hash, 16)) {
-	debug(DBG_WARN, "message authenticator, wrong value");
-	pthread_mutex_unlock(&lock);
-	return 0;
-    }	
-	
-    pthread_mutex_unlock(&lock);
-    return 1;
-}
-
 int createmessageauth(unsigned char *rad, unsigned char *authattrval, char *secret) {
     static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
     static unsigned char first = 1;
@@ -1458,136 +1396,100 @@ int findvendorsubattr(uint32_t *attrs, uint32_t vendor, uint8_t subattr) {
     return 0;
 }
 
-int dovendorrewriterm(uint8_t *attrs, uint16_t length, uint32_t *removevendorattrs) {
-    uint8_t alen, sublen, rmlen = 0;
-    uint32_t vendor = *(uint32_t *)ATTRVAL(attrs);
+/* returns 1 if entire element is to be removed, else 0 */
+int dovendorrewriterm(struct tlv *attr, uint32_t *removevendorattrs) {
+    uint8_t alen, sublen;
+    uint32_t vendor;
     uint8_t *subattrs;
     
     if (!removevendorattrs)
 	return 0;
 
+    memcpy(&vendor, attr->v, 4);
+    vendor = ntohl(vendor);
     while (*removevendorattrs && *removevendorattrs != vendor)
 	removevendorattrs += 2;
     if (!*removevendorattrs)
 	return 0;
     
-    alen = ATTRLEN(attrs);
-
-    if (findvendorsubattr(removevendorattrs, vendor, -1)) {
-	/* remove entire vendor attribute */
-	memmove(attrs, attrs + alen, length - alen);
-	return alen;
-    }
+    if (findvendorsubattr(removevendorattrs, vendor, -1))
+	return 1; /* remove entire vendor attribute */
 
-    sublen = alen - 4;
-    subattrs = ATTRVAL(attrs) + 4;
+    sublen = attr->l - 4;
+    subattrs = attr->v + 4;
     
     if (!attrvalidate(subattrs, sublen)) {
 	debug(DBG_WARN, "dovendorrewrite: vendor attribute validation failed, no rewrite");
 	return 0;
     }
 
-    length -= 6;
     while (sublen > 1) {
 	alen = ATTRLEN(subattrs);
 	sublen -= alen;
-	length -= alen;
 	if (findvendorsubattr(removevendorattrs, vendor, ATTRTYPE(subattrs))) {
-	    memmove(subattrs, subattrs + alen, length);
-	    rmlen += alen;
+	    memmove(subattrs, subattrs + alen, sublen);
+	    attr->l -= alen;
 	} else
 	    subattrs += alen;
     }
-
-    ATTRLEN(attrs) -= rmlen;
-    return rmlen;
+    return 0;
 }
 
-void dorewriterm(uint8_t *buf, uint8_t *rmattrs, uint32_t *rmvattrs) {
-    uint8_t *attrs, alen;
-    uint16_t len, rmlen = 0;
-    
-    len = RADLEN(buf) - 20;
-    attrs = buf + 20;
-    while (len > 1) {
-	alen = ATTRLEN(attrs);
-	len -= alen;
-	if (rmattrs && strchr((char *)rmattrs, ATTRTYPE(attrs))) {
-	    memmove(attrs, attrs + alen, len);
-	    rmlen += alen;
-	} else if (ATTRTYPE(attrs) == RAD_Attr_Vendor_Specific && rmvattrs)
-	    rmlen += dovendorrewriterm(attrs, len, rmvattrs);
-	else
-	    attrs += alen;
+void dorewriterm(struct radmsg *msg, uint8_t *rmattrs, uint32_t *rmvattrs) {
+    struct list_node *n, *p;
+    struct tlv *attr;
+
+    p = NULL;
+    n = list_first(msg->attrs);
+    while (n) {
+	attr = (struct tlv *)n->data;
+	if ((rmattrs && strchr((char *)rmattrs, attr->t)) ||
+	    (rmvattrs && attr->t == RAD_Attr_Vendor_Specific && dovendorrewriterm(attr, rmvattrs))) {
+	    list_removedata(msg->attrs, attr);
+	    freetlv(attr);
+	    n = p ? list_next(p) : list_first(msg->attrs);
+	} else
+	    p = n;
+            n = list_next(n);
     }
-    if (rmlen)
-	((uint16_t *)buf)[1] = htons(RADLEN(buf) - rmlen);
 }
 
-int dorewriteadd(uint8_t **buf, struct list *addattrs) {
+int dorewriteadd(struct radmsg *msg, struct list *addattrs) {
     struct list_node *n;
-    struct attribute *a;
-    uint16_t i, addlen = 0;
-    uint8_t *newbuf;
+    struct tlv *a;
     
-    for (n = list_first(addattrs); n; n = list_next(n))
-	addlen += 2 + ((struct attribute *)n->data)->l;
-    if (!addlen)
-	return 1;
-    newbuf = realloc(*buf, RADLEN(*buf) + addlen);
-    if (!newbuf)
-	return 0;
-
-    i = RADLEN(newbuf);
     for (n = list_first(addattrs); n; n = list_next(n)) {
-	a = (struct attribute *)n->data;
-	newbuf[i++] = a->t;
-	newbuf[i++] = a->l + 2;
-	memcpy(newbuf + i, a->v, a->l);
-	i += a->l;
-    }
-    ((uint16_t *)newbuf)[1] = htons(RADLEN(newbuf) + addlen);
-    *buf = newbuf;
+	a = copytlv((struct tlv *)n->data);
+	if (!a)
+	    return 0;
+	if (!radmsg_add(msg, a)) {
+	    freetlv(a);
+	    return 0;
+	}
+    }
     return 1;
 }
 
-/* returns a pointer to the resized attribute value */
-uint8_t *resizeattr(uint8_t **buf, uint8_t **attr, uint8_t newvallen) {
-    uint8_t vallen;
-    uint16_t len;
-    unsigned char *new;
-    
-    vallen = ATTRVALLEN(*attr);
-    if (vallen == newvallen)
-	return *attr + 2;
+int resizeattr2(struct tlv *attr, uint8_t newlen) {
+    uint8_t *newv;
     
-    len = RADLEN(*buf) + newvallen - vallen;
-
-    if (newvallen > vallen) {
-	new = realloc(*buf, len);
-	if (!new) {
-	    debug(DBG_ERR, "resizeattr: malloc failed");
-	    return NULL;
-	}
-	if (new != *buf) {
-	    *attr += new - *buf;
-	    *buf = new;
-	}
+    if (newlen != attr->l) {
+	newv = realloc(attr->v, newlen);
+	if (!newv)
+	    return 0;
+	attr->v = newv;
+	attr->l = newlen;
     }
-    memmove(*attr + 2 + newvallen, *attr + 2 + vallen, len - (*attr - *buf + newvallen));
-    (*attr)[1] = newvallen + 2;
-    ((uint16_t *)*buf)[1] = htons(len);
-    return *attr + 2;
+    return 1;
 }
 
-int dorewritemodattr(uint8_t **buf, uint8_t **attr, struct modattr *modattr) {
+int dorewritemodattr(struct tlv *attr, struct modattr *modattr) {
     size_t nmatch = 10, reslen = 0, start = 0;
     regmatch_t pmatch[10], *pfield;
     int i;
-    unsigned char *result;
     char *in, *out;
 
-    in = stringcopy((char *)ATTRVAL(*attr), ATTRVALLEN(*attr));
+    in = stringcopy((char *)attr->v, attr->l);
     if (!in)
 	return 0;
     
@@ -1614,21 +1516,21 @@ int dorewritemodattr(uint8_t **buf, uint8_t **attr, struct modattr *modattr) {
 	free(in);
 	return 0;
     }
-    result = resizeattr(buf, attr, reslen);
-    if (!result) {
+
+    if (!resizeattr2(attr, reslen)) {
 	free(in);
 	return 0;
     }
-    
+
     start = 0;
     reslen = 0;
     for (i = start; out[i]; i++) {
 	if (out[i] == '\\' && out[i + 1] >= '1' && out[i + 1] <= '9') {
 	    pfield = &pmatch[out[i + 1] - '0'];
 	    if (pfield->rm_so >= 0) {
-		memcpy(result + reslen, out + start, i - start);
+		memcpy(attr->v + reslen, out + start, i - start);
 		reslen += i - start;
-		memcpy(result + reslen, in + pfield->rm_so, pfield->rm_eo - pfield->rm_so);
+		memcpy(attr->v + reslen, in + pfield->rm_so, pfield->rm_eo - pfield->rm_so);
 		reslen += pfield->rm_eo - pfield->rm_so;
 		start = i + 2;
 	    }
@@ -1636,51 +1538,43 @@ int dorewritemodattr(uint8_t **buf, uint8_t **attr, struct modattr *modattr) {
 	}
     }
 
-    memcpy(result + reslen, out + start, i - start);
+    memcpy(attr->v + reslen, out + start, i - start);
     return 1;
 }
-   
-int dorewritemod(uint8_t **buf, struct list *modattrs) {
-    uint8_t *attr;
-    uint16_t len = 0;
-    struct list_node *n;
 
-    attr = *buf + 20;
-    while (RADLEN(*buf) - 22 >= len) {
-	for (n = list_first(modattrs); n; n = list_next(n))
-	    if (ATTRTYPE(attr) == ((struct modattr *)n->data)->t)
-		if (!dorewritemodattr(buf, &attr, (struct modattr *)n->data))
-		    return 0;
-	len += ATTRLEN(attr);
-	attr += ATTRLEN(attr);
-    }
+int dorewritemod(struct radmsg *msg, struct list *modattrs) {
+    struct list_node *n, *m;
+
+    for (n = list_first(msg->attrs); n; n = list_next(n))
+	for (m = list_first(modattrs); m; m = list_next(m))
+	    if (((struct tlv *)n->data)->t == ((struct modattr *)m->data)->t &&
+		!dorewritemodattr((struct tlv *)n->data, (struct modattr *)m->data))
+		return 0;
     return 1;
 }
 
-int dorewrite(uint8_t **buf, struct rewrite *rewrite) {
+int dorewrite(struct radmsg *msg, struct rewrite *rewrite) {
     if (!rewrite)
 	return 1;
     if (rewrite->removeattrs || rewrite->removevendorattrs)
-	dorewriterm(*buf, rewrite->removeattrs, rewrite->removevendorattrs);
-    if (rewrite->addattrs && !dorewriteadd(buf, rewrite->addattrs))
+	dorewriterm(msg, rewrite->removeattrs, rewrite->removevendorattrs);
+    if (rewrite->addattrs && !dorewriteadd(msg, rewrite->addattrs))
 	return 0;
-    if (rewrite->modattrs && !dorewritemod(buf, rewrite->modattrs))
+    if (rewrite->modattrs && !dorewritemod(msg, rewrite->modattrs))
 	return 0;
     return 1;
 }
-    
-int rewriteusername(struct request *rq, uint8_t *attr, char *in) {
-    if (!dorewritemodattr(&rq->buf, &attr, rq->from->conf->rewriteusername))
-	return 0;
-    if (strlen(in) == ATTRVALLEN(attr) && !memcmp(in, ATTRVAL(attr), ATTRVALLEN(attr)))
-	return 1;
 
-    rq->origusername = stringcopy(in, 0);
-    if (!rq->origusername)
+int rewriteusername(struct request *rq, struct tlv *attr) {
+    char *orig = (char *)tlv2str(attr);
+    if (!dorewritemodattr(attr, rq->from->conf->rewriteusername)) {
+	free(orig);
 	return 0;
-    
-    memcpy(in, ATTRVAL(attr), ATTRVALLEN(attr));
-    in[ATTRVALLEN(attr)] = '\0';
+    }
+    if (strlen(orig) != attr->l || memcmp(orig, attr->v, attr->l))
+	rq->origusername = (char *)orig;
+    else
+	free(orig);
     return 1;
 }
 
@@ -1734,19 +1628,52 @@ char *radattr2ascii(char *ascii, size_t len, unsigned char *attr) {
     return ascii;
 }
 
-void acclog(unsigned char *attrs, int length, char *host) {
-    unsigned char *attr;
-    char username[760];
+uint8_t *radattr2ascii2(struct tlv *attr) {
+    int i, l;
+    uint8_t *a, *d;
+
+    if (!attr)
+	return NULL;
+
+    l = attr->l;
+    for (i = 0; i < attr->l; i++)
+	if (attr->v[i] < 32 || attr->v[i] > 126)
+	    l += 2;
+    if (l == attr->l)
+	return (uint8_t *)stringcopy((char *)attr->v, attr->l);
+    
+    a = malloc(l + 1);
+    if (!a)
+	return NULL;
+
+    d = a;
+    for (i = 0; i < attr->l; i++)
+	if (attr->v[i] < 32 || attr->v[i] > 126) {
+	    *d++ = '%';
+	    char2hex((char *)d, attr->v[i]);
+	    d += 2;
+	} else
+	    *d++ = attr->v[i];
+    *d = '\0';
+    return a;
+}
+
+void acclog(struct radmsg *msg, char *host) {
+    struct tlv *attr;
+    uint8_t *username;
     
-    attr = attrget(attrs, length, RAD_Attr_User_Name);
+    attr = radmsg_gettype(msg, RAD_Attr_User_Name);
     if (!attr) {
 	debug(DBG_INFO, "acclog: accounting-request from %s without username attribute", host);
 	return;
     }
-    radattr2ascii(username, sizeof(username), attr);
-    debug(DBG_INFO, "acclog: accounting-request from %s with username: %s", host, username);
+    username = radattr2ascii2(attr);
+    if (username) {
+	debug(DBG_INFO, "acclog: accounting-request from %s with username: %s", host, username);
+	free(username);
+    }
 }
-	
+
 void respondaccounting(struct request *rq) {
     unsigned char *resp;
 
@@ -1826,115 +1753,92 @@ struct clsrvconf *choosesrvconf(struct list *srvconfs) {
     return best ? best : first;
 }
 
-struct server *findserver(struct realm **realm, char *id, uint8_t acc) {
+struct server *findserver(struct realm **realm, struct tlv *username, uint8_t acc) {
     struct clsrvconf *srvconf;
+    char *id = (char *)tlv2str(username);
     
+    if (!id)
+	return NULL;
     *realm = id2realm(realms, id);
-    if (!*realm)
+    if (!*realm) {
+	free(id);
 	return NULL;
+    }
     debug(DBG_DBG, "found matching realm: %s", (*realm)->name);
     srvconf = choosesrvconf(acc ? (*realm)->accsrvconfs : (*realm)->srvconfs);
-    if (!srvconf)
+    if (!srvconf) {
+	free(id);
 	return NULL;
+    }
     if (!acc && !srvconf->servers)
 	adddynamicrealmserver(*realm, srvconf, id);
+    free(id);
     return srvconf->servers;
 }
 
 /* returns 0 if validation/authentication fails, else 1 */
 int radsrv(struct request *rq) {
-    uint8_t code, id, *auth, *attrs, *attr;
-    uint16_t len;
-    struct server *to = NULL;
-    char username[254], userascii[760];
+    struct radmsg *msg = NULL;
+    struct tlv *attr;
+    uint8_t *userascii = NULL;
     unsigned char newauth[16];
     struct realm *realm = NULL;
-    
-    code = *(uint8_t *)rq->buf;
-    id = *(uint8_t *)(rq->buf + 1);
-    len = RADLEN(rq->buf);
-    auth = (uint8_t *)(rq->buf + 4);
+    struct server *to = NULL;
 
-    debug(DBG_DBG, "radsrv: code %d, id %d, length %d", code, id, len);
+    msg = buf2radmsg(rq->buf, (uint8_t *)rq->from->conf->secret, NULL);
+    if (!msg) {
+	debug(DBG_WARN, "radsrv: message validation failed, ignoring packet");
+	freerqdata(rq);
+	return 0;
+    }
+    debug(DBG_DBG, "radsrv: code %d, id %d", msg->code, msg->id);
     
-    if (code != RAD_Access_Request && code != RAD_Status_Server && code != RAD_Accounting_Request) {
+    if (msg->code != RAD_Access_Request && msg->code != RAD_Status_Server && msg->code != RAD_Accounting_Request) {
 	debug(DBG_INFO, "radsrv: server currently accepts only access-requests, accounting-requests and status-server, ignoring");
 	goto exit;
     }
 
-    len -= 20;
-    attrs = rq->buf + 20;
-
-    if (!attrvalidate(attrs, len)) {
-	debug(DBG_WARN, "radsrv: attribute validation failed, ignoring packet");
-	goto errvalauth;
-    }
-
-    attr = attrget(attrs, len, RAD_Attr_Message_Authenticator);
-    if (attr && (ATTRVALLEN(attr) != 16 || !checkmessageauth(rq->buf, ATTRVAL(attr), rq->from->conf->secret))) {
-	debug(DBG_WARN, "radsrv: message authentication failed");
-	goto errvalauth;
-    }
-
-    if (code == RAD_Status_Server) {
+    if (msg->code == RAD_Status_Server) {
 	respondstatusserver(rq);
 	goto exit;
     }
-    
+
     /* below: code == RAD_Access_Request || code == RAD_Accounting_Request */
 
-    if (code == RAD_Accounting_Request) {
-	memset(newauth, 0, 16);
-	if (!validauth(rq->buf, newauth, (unsigned char *)rq->from->conf->secret)) {
-	    debug(DBG_WARN, "radsrv: Accounting-Request message authentication failed");
-	    goto errvalauth;
-	}
-    }
-    
-    if (rq->from->conf->rewritein) {
-	if (!dorewrite(&rq->buf, rq->from->conf->rewritein))
-	    goto exit;
-	len = RADLEN(rq->buf) - 20;
-	auth = (uint8_t *)(rq->buf + 4);
-	attrs = rq->buf + 20;
-    }
-    
-    attr = attrget(attrs, len, RAD_Attr_User_Name);
+    if (rq->from->conf->rewritein && !dorewrite(msg, rq->from->conf->rewritein))
+	goto exit;
+
+    attr = radmsg_gettype(msg, RAD_Attr_User_Name);
     if (!attr) {
-	if (code == RAD_Accounting_Request) {
-	    acclog(attrs, len, rq->from->conf->host);
+	if (msg->code == RAD_Accounting_Request) {
+	    acclog(msg, rq->from->conf->host);
 	    respondaccounting(rq);
 	} else
 	    debug(DBG_WARN, "radsrv: ignoring access request, no username attribute");
 	goto exit;
     }
-    memcpy(username, ATTRVAL(attr), ATTRVALLEN(attr));
-    username[ATTRVALLEN(attr)] = '\0';
-    radattr2ascii(userascii, sizeof(userascii), attr);
 
-    if (rq->from->conf->rewriteusername) {
-	if (!rewriteusername(rq, attr, username)) {
-	    debug(DBG_WARN, "radsrv: username malloc failed, ignoring request");
-	    goto exit;
-	}
-	len = RADLEN(rq->buf) - 20;
-	auth = (uint8_t *)(rq->buf + 4);
-	attrs = rq->buf + 20;
+    if (rq->from->conf->rewriteusername && !rewriteusername(rq, attr)) {
+	debug(DBG_WARN, "radsrv: username malloc failed, ignoring request");
+	goto exit;
     }
-
-    debug(DBG_DBG, "%s with username: %s", radmsgtype2string(code), userascii);
     
-    to = findserver(&realm, username, code == RAD_Accounting_Request);
+    userascii = radattr2ascii2(attr);
+    if (!userascii)
+	goto exit;
+    debug(DBG_DBG, "%s with username: %s", radmsgtype2string(msg->code), userascii);
+
+    to = findserver(&realm, attr, msg->code == RAD_Accounting_Request);
     if (!realm) {
 	debug(DBG_INFO, "radsrv: ignoring request, don't know where to send it");
 	goto exit;
     }
     if (!to) {
-	if (realm->message && code == RAD_Access_Request) {
+	if (realm->message && msg->code == RAD_Access_Request) {
 	    debug(DBG_INFO, "radsrv: sending reject to %s for %s", rq->from->conf->host, userascii);
 	    respondreject(rq, realm->message);
-	} else if (realm->accresp && code == RAD_Accounting_Request) {
-	    acclog(attrs, len, rq->from->conf->host);
+	} else if (realm->accresp && msg->code == RAD_Accounting_Request) {
+	    acclog(msg, rq->from->conf->host);
 	    respondaccounting(rq);
 	}
 	goto exit;
@@ -1946,13 +1850,13 @@ int radsrv(struct request *rq) {
 	goto exit;
     }
 
-    if (rqinqueue(to, rq->from, id, code)) {
+    if (rqinqueue(to, rq->from, msg->id, msg->code)) {
 	debug(DBG_INFO, "radsrv: already got %s from host %s with id %d, ignoring",
-	      radmsgtype2string(code), rq->from->conf->host, id);
+	      radmsgtype2string(msg->code), rq->from->conf->host, msg->id);
 	goto exit;
     }
     
-    if (code != RAD_Accounting_Request) {
+    if (msg->code != RAD_Accounting_Request) {
 	if (!RAND_bytes(newauth, 16)) {
 	    debug(DBG_WARN, "radsrv: failed to generate random auth");
 	    goto exit;
@@ -1963,146 +1867,116 @@ int radsrv(struct request *rq) {
     printfchars(NULL, "auth", "%02x ", auth, 16);
 #endif
 
-    attr = attrget(attrs, len, RAD_Attr_User_Password);
+    attr = radmsg_gettype(msg, RAD_Attr_User_Password);
     if (attr) {
-	debug(DBG_DBG, "radsrv: found userpwdattr with value length %d", ATTRVALLEN(attr));
-	if (!pwdrecrypt(ATTRVAL(attr), ATTRVALLEN(attr), rq->from->conf->secret, to->conf->secret, auth, newauth))
+	debug(DBG_DBG, "radsrv: found userpwdattr with value length %d", attr->l);
+	if (!pwdrecrypt(attr->v, attr->l, rq->from->conf->secret, to->conf->secret, msg->auth, newauth))
 	    goto exit;
     }
-    
-    attr = attrget(attrs, len, RAD_Attr_Tunnel_Password);
+
+    attr = radmsg_gettype(msg, RAD_Attr_Tunnel_Password);
     if (attr) {
-	debug(DBG_DBG, "radsrv: found tunnelpwdattr with value length %d", ATTRVALLEN(attr));
-	if (!pwdrecrypt(ATTRVAL(attr), ATTRVALLEN(attr), rq->from->conf->secret, to->conf->secret, auth, newauth))
+	debug(DBG_DBG, "radsrv: found tunnelpwdattr with value length %d", attr->l);
+	if (!pwdrecrypt(attr->v, attr->l, rq->from->conf->secret, to->conf->secret, msg->auth, newauth))
 	    goto exit;
     }
 
-    rq->origid = id;
-    memcpy(rq->origauth, auth, 16);
-    memcpy(auth, newauth, 16);
+    rq->origid = msg->id;
+    memcpy(rq->origauth, msg->auth, 16);
+    memcpy(msg->auth, newauth, 16);    
 
-    if (to->conf->rewriteout)
-	if (!dorewrite(&rq->buf, to->conf->rewriteout))
-	    goto exit;
+    if (to->conf->rewriteout && !dorewrite(msg, to->conf->rewriteout))
+	goto exit;
     
+    free(rq->buf);
+    rq->buf = radmsg2buf(msg);
+    if (!rq->buf)
+	goto exit;
+    free(userascii);
+    radmsg_free(msg);
+
     sendrq(to, rq);
     return 1;
     
  exit:
+    free(userascii);
+    radmsg_free(msg);
     freerqdata(rq);
     return 1;
-
- errvalauth:
-    freerqdata(rq);
-    return 0;
 }
 
 int replyh(struct server *server, unsigned char *buf) {
     struct client *from;
     struct request *rq;
-    int i, len, sublen;
-    unsigned char *messageauth, *subattrs, *attrs, *attr, *username;
+    int sublen;
+    unsigned char *subattrs, *rqattr;
     struct sockaddr_storage fromsa;
     char tmp[760], stationid[760];
+    struct radmsg *msg = NULL;
+    struct tlv *attr, *messageauth;
+    struct list_node *node;
     
     server->connectionok = 1;
     server->lostrqs = 0;
-	
-    i = buf[1]; /* i is the id */
 
-    if (*buf != RAD_Access_Accept && *buf != RAD_Access_Reject && *buf != RAD_Access_Challenge
-	&& *buf != RAD_Accounting_Response) {
-	debug(DBG_INFO, "replyh: discarding message type %s, accepting only access accept, access reject, access challenge and accounting response messages", radmsgtype2string(*buf));
+    rq = server->requests + buf[1];
+    msg = buf2radmsg(buf, (uint8_t *)server->conf->secret, rq->buf + 4);
+    if (!msg) {
+        debug(DBG_WARN, "replyh: message validation failed, ignoring packet");
 	return 0;
     }
-    debug(DBG_DBG, "got %s message with id %d", radmsgtype2string(*buf), i);
-
-    rq = server->requests + i;
+    if (msg->code != RAD_Access_Accept && msg->code != RAD_Access_Reject && msg->code != RAD_Access_Challenge
+	&& msg->code != RAD_Accounting_Response) {
+	debug(DBG_INFO, "replyh: discarding message type %s, accepting only access accept, access reject, access challenge and accounting response messages", radmsgtype2string(msg->code));
+	radmsg_free(msg);
+	return 0;
+    }
+    debug(DBG_DBG, "got %s message with id %d", radmsgtype2string(msg->code), msg->id);
 
     pthread_mutex_lock(&server->newrq_mutex);
     if (!rq->buf || !rq->tries) {
-	pthread_mutex_unlock(&server->newrq_mutex);
 	debug(DBG_INFO, "replyh: no matching request sent with this id, ignoring reply");
-	return 0;
+	goto errunlock;
     }
 
     if (rq->received) {
-	pthread_mutex_unlock(&server->newrq_mutex);
 	debug(DBG_INFO, "replyh: already received, ignoring reply");
-	return 0;
-    }
-	
-    if (!validauth(buf, rq->buf + 4, (unsigned char *)server->conf->secret)) {
-	pthread_mutex_unlock(&server->newrq_mutex);
-	debug(DBG_WARN, "replyh: invalid auth, ignoring reply");
-	return 0;
-    }
-	
-    len = RADLEN(buf) - 20;
-    attrs = buf + 20;
-
-    if (!attrvalidate(attrs, len)) {
-	pthread_mutex_unlock(&server->newrq_mutex);
-	debug(DBG_WARN, "replyh: attribute validation failed, ignoring reply");
-	return 0;
+	goto errunlock;
     }
 	
-    /* Message Authenticator */
-    messageauth = attrget(attrs, len, RAD_Attr_Message_Authenticator);
-    if (messageauth) {
-	if (ATTRVALLEN(messageauth) != 16) {
-	    pthread_mutex_unlock(&server->newrq_mutex);
-	    debug(DBG_WARN, "replyh: illegal message auth attribute length, ignoring reply");
-	    return 0;
-	}
-	memcpy(tmp, buf + 4, 16);
-	memcpy(buf + 4, rq->buf + 4, 16);
-	if (!checkmessageauth(buf, ATTRVAL(messageauth), server->conf->secret)) {
-	    pthread_mutex_unlock(&server->newrq_mutex);
-	    debug(DBG_WARN, "replyh: message authentication failed, ignoring reply");
-	    return 0;
-	}
-	memcpy(buf + 4, tmp, 16);
-	debug(DBG_DBG, "replyh: message auth ok");
-    }
-    
     gettimeofday(&server->lastrcv, NULL);
     
     if (*rq->buf == RAD_Status_Server) {
 	rq->received = 1;
-	pthread_mutex_unlock(&server->newrq_mutex);
 	debug(DBG_DBG, "replyh: got status server response from %s", server->conf->host);
-	return 0;
+	goto errunlock;
     }
 
     gettimeofday(&server->lastreply, NULL);
     
     from = rq->from;
     if (!from) {
-	pthread_mutex_unlock(&server->newrq_mutex);
 	debug(DBG_INFO, "replyh: client gone, ignoring reply");
-	return 0;
+	goto errunlock;
     }
 	
-    if (server->conf->rewritein) {
-	if (!dorewrite(&buf, server->conf->rewritein))
-	    return 0;
-	len = RADLEN(buf) - 20;
-	attrs = buf + 20;
-	if (messageauth)
-	    messageauth = attrget(attrs, len, RAD_Attr_Message_Authenticator);
+    if (server->conf->rewritein && !dorewrite(msg, rq->from->conf->rewritein)) {
+	debug(DBG_WARN, "replyh: rewritein failed");
+	goto errunlock;
     }
     
     /* MS MPPE */
-    for (attr = attrs; (attr = attrget(attr, len - (attr - attrs), RAD_Attr_Vendor_Specific)); attr += ATTRLEN(attr)) {
-	if (ATTRVALLEN(attr) <= 4)
+    for (node = list_first(msg->attrs); node; node = list_next(node)) {
+	attr = (struct tlv *)node->data;
+	if (attr->t != RAD_Attr_Vendor_Specific)
+	    continue;
+	if (attr->l <= 4)
 	    break;
-	    
-	if (attr[2] != 0 || attr[3] != 0 || attr[4] != 1 || attr[5] != 55)  /* 311 == MS */
+	if (attr->v[0] != 0 || attr->v[1] != 0 || attr->v[2] != 1 || attr->v[3] != 55)  /* 311 == MS */
 	    continue;
 	    
-	sublen = ATTRVALLEN(attr) - 4;
-	subattrs = ATTRVAL(attr) + 4;  
+	sublen = attr->l - 4;
+	subattrs = attr->v + 4;  
 	if (!attrvalidate(subattrs, sublen) ||
 	    !msmppe(subattrs, sublen, RAD_VS_ATTR_MS_MPPE_Send_Key, "MS MPPE Send Key",
 		    rq, server->conf->secret, from->conf->secret) ||
@@ -2110,62 +1984,63 @@ int replyh(struct server *server, unsigned char *buf) {
 		    rq, server->conf->secret, from->conf->secret))
 	    break;
     }
-    if (attr) {
-	pthread_mutex_unlock(&server->newrq_mutex);
+    if (node) {
 	debug(DBG_WARN, "replyh: MS attribute handling failed, ignoring reply");
-	return 0;
+	goto errunlock;
     }
-	
-    if (*buf == RAD_Access_Accept || *buf == RAD_Access_Reject || *buf == RAD_Accounting_Response) {
-	attr = attrget(rq->buf + 20, RADLEN(rq->buf) - 20, RAD_Attr_User_Name);
-	if (attr) {
-	    radattr2ascii(tmp, sizeof(tmp), attr);
-	    attr = attrget(rq->buf + 20, RADLEN(rq->buf) - 20, RAD_Attr_Calling_Station_Id);
-	    if (attr) {
-		radattr2ascii(stationid, sizeof(stationid), attr);
+
+    if (msg->code == RAD_Access_Accept || msg->code == RAD_Access_Reject || msg->code == RAD_Accounting_Response) {
+	rqattr = attrget(rq->buf + 20, RADLEN(rq->buf) - 20, RAD_Attr_User_Name);	
+	if (rqattr) {
+	    radattr2ascii(tmp, sizeof(tmp), rqattr);
+	    rqattr = attrget(rq->buf + 20, RADLEN(rq->buf) - 20, RAD_Attr_Calling_Station_Id);
+	    if (rqattr) {
+		radattr2ascii(stationid, sizeof(stationid), rqattr);
 		debug(DBG_INFO, "%s for user %s stationid %s from %s",
-		      radmsgtype2string(*buf), tmp, stationid, server->conf->host);
+		      radmsgtype2string(msg->code), tmp, stationid, server->conf->host);
 	    } else
-		debug(DBG_INFO, "%s for user %s from %s", radmsgtype2string(*buf), tmp, server->conf->host);
+		debug(DBG_INFO, "%s for user %s from %s", radmsgtype2string(msg->code), tmp, server->conf->host);
 	}
     }
-	
-    buf[1] = (char)rq->origid;
-    memcpy(buf + 4, rq->origauth, 16);
+
+    msg->id = (char)rq->origid;
+    memcpy(msg->auth, rq->origauth, 16);
+
 #ifdef DEBUG	
     printfchars(NULL, "origauth/buf+4", "%02x ", buf + 4, 16);
 #endif
 
-    if (rq->origusername && (attr = attrget(buf + 20, RADLEN(buf) - 20, RAD_Attr_User_Name))) {
-	username = resizeattr(&buf, &attr, strlen(rq->origusername));
-	if (!username) {
-	    pthread_mutex_unlock(&server->newrq_mutex);
+    if (rq->origusername && (attr = radmsg_gettype(msg, RAD_Attr_User_Name))) {
+	if (!resizeattr2(attr, strlen(rq->origusername))) {
 	    debug(DBG_WARN, "replyh: malloc failed, ignoring reply");
-	    return 0;
+	    goto errunlock;
 	}
-	memcpy(username, rq->origusername, strlen(rq->origusername));
-	len = RADLEN(buf) - 20;
-	attrs = buf + 20;
-	if (messageauth)
-	    messageauth = attrget(attrs, len, RAD_Attr_Message_Authenticator);
+	memcpy(attr->v, rq->origusername, strlen(rq->origusername));
     }
-    
-    if (from->conf->rewriteout) {
-	if (!dorewrite(&buf, from->conf->rewriteout))
-	    return 0;
-	len = RADLEN(buf) - 20;
-	attrs = buf + 20;
-	if (messageauth)
-	    messageauth = attrget(attrs, len, RAD_Attr_Message_Authenticator);
+
+    if (from->conf->rewriteout && !dorewrite(msg, from->conf->rewriteout)) {
+	debug(DBG_WARN, "replyh: rewriteout failed");
+	goto errunlock;
     }
-	
+
+    free(buf);
+    buf = radmsg2buf(msg);
+    radmsg_free(msg);
+    msg = NULL;
+    if (!buf) {
+	debug(DBG_ERR, "replyh: malloc failed");
+	goto errunlock;
+    }
+    
     if (messageauth) {
-	if (!createmessageauth(buf, ATTRVAL(messageauth), from->conf->secret)) {
-	    pthread_mutex_unlock(&server->newrq_mutex);
-	    debug(DBG_WARN, "replyh: failed to create authenticator, malloc failed?, ignoring reply");
-	    return 0;
+	rqattr = attrget(buf + 20, RADLEN(buf) - 20, RAD_Attr_Message_Authenticator);
+	if (rqattr) {
+	    if (!createmessageauth(buf, ATTRVAL(rqattr), from->conf->secret)) {
+		debug(DBG_WARN, "replyh: failed to create authenticator, malloc failed?, ignoring reply");
+		goto errunlock;
+	    }
+	    debug(DBG_DBG, "replyh: computed messageauthattr");
 	}
-	debug(DBG_DBG, "replyh: computed messageauthattr");
     }
 
     fromsa = rq->fromsa; /* only needed for UDP */
@@ -2176,6 +2051,11 @@ int replyh(struct server *server, unsigned char *buf) {
     sendreply(from, buf, &fromsa, rq->fromudpsock);
     pthread_mutex_unlock(&server->newrq_mutex);
     return 1;
+
+ errunlock:
+    radmsg_free(msg);
+    pthread_mutex_unlock(&server->newrq_mutex);
+    return 0;
 }
 
 /* code for removing state not finished */
@@ -2915,10 +2795,10 @@ int vattrname2val(char *attrname, uint32_t *vendor, uint32_t *type) {
 }
 
 /* should accept both names and numeric values, only numeric right now */
-struct attribute *extractattr(char *nameval) {
+struct tlv *extractattr(char *nameval) {
     int len, name = 0;
     char *s;
-    struct attribute *a;
+    struct tlv *a;
     
     s = strchr(nameval, ':');
     name = atoi(nameval);
@@ -2927,7 +2807,7 @@ struct attribute *extractattr(char *nameval) {
     len = strlen(s + 1);
     if (len > 253)
 	return NULL;
-    a = malloc(sizeof(struct attribute));
+    a = malloc(sizeof(struct tlv));
     if (!a)
 	return NULL;
     a->v = (uint8_t *)stringcopy(s + 1, 0);
@@ -3015,7 +2895,7 @@ void addrewrite(char *value, char **rmattrs, char **rmvattrs, char **addattrs, c
     uint8_t *rma = NULL;
     uint32_t *p, *rmva = NULL;
     struct list *adda = NULL, *moda = NULL;
-    struct attribute *a;
+    struct tlv *a;
     struct modattr *m;
     
     if (rmattrs) {