summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--ChangeLog6
-rw-r--r--gconfig.c1
-rw-r--r--radmsg.c2
-rw-r--r--radsecproxy.c39
-rw-r--r--tlscommon.c1
-rw-r--r--util.c40
6 files changed, 55 insertions, 34 deletions
diff --git a/ChangeLog b/ChangeLog
index 4f7e485..eabbb60 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2017-10-?? 1.6.9
+ Bug fixes:
+ - Completely reload CAs and CRLs with cacheExpiry (RADSECPROXY-50).
+ - Tie Access-Request log lines to response log lines (RADSECPROXY-60).
+ - Fix a couple of memory leaks and NULL ptr derefs in error cases.
+
2016-09-21 1.6.8
Bug fixes:
- Stop waiting on writable when reading a TCP socket.
diff --git a/gconfig.c b/gconfig.c
index b7107aa..38a33ff 100644
--- a/gconfig.c
+++ b/gconfig.c
@@ -541,6 +541,7 @@ int getgenericconfig(struct gconffile **cf, char *block, ...) {
errparam:
debug(DBG_ERR, "getgenericconfig: internal parameter error");
errexit:
+ va_end(ap);
free(opt);
free(val);
return 0;
diff --git a/radmsg.c b/radmsg.c
index 7f6dd9d..7ff094b 100644
--- a/radmsg.c
+++ b/radmsg.c
@@ -308,7 +308,7 @@ struct radmsg *buf2radmsg(uint8_t *buf, uint8_t *secret, uint8_t *rqauth) {
}
}
- if (rqauth && !_validauth(buf, rqauth, secret)) {
+ if (rqauth && secret && !_validauth(buf, rqauth, secret)) {
debug(DBG_WARN, "buf2radmsg: Invalid auth, ignoring reply");
return NULL;
}
diff --git a/radsecproxy.c b/radsecproxy.c
index 7029d8a..f428e6c 100644
--- a/radsecproxy.c
+++ b/radsecproxy.c
@@ -222,12 +222,7 @@ void freebios(struct gqueue *q) {
}
struct client *addclient(struct clsrvconf *conf, uint8_t lock) {
- struct client *new = malloc(sizeof(struct client));
-
- if (!new) {
- debug(DBG_ERR, "malloc failed");
- return NULL;
- }
+ struct client *new = NULL;
if (lock)
pthread_mutex_lock(conf->lock);
@@ -241,7 +236,11 @@ struct client *addclient(struct clsrvconf *conf, uint8_t lock) {
}
}
- memset(new, 0, sizeof(struct client));
+ new = calloc(1, sizeof(struct client));
+ if (!new) {
+ debug(DBG_ERR, "malloc failed");
+ return NULL;
+ }
new->conf = conf;
if (conf->pdef->addclient)
conf->pdef->addclient(new);
@@ -537,7 +536,8 @@ errexit:
if (rq->from)
rmclientrq(rq, rq->msg->id);
freerq(rq);
- pthread_mutex_unlock(&to->newrq_mutex);
+ if (to)
+ pthread_mutex_unlock(&to->newrq_mutex);
removeclientrqs_sendrq_freeserver_lock(0);
}
@@ -1066,6 +1066,7 @@ int dorewritemodattr(struct tlv *attr, struct modattr *modattr) {
i++;
}
}
+ free(in);
memcpy(attr->v + reslen, out + start, i - start);
return 1;
@@ -1130,9 +1131,8 @@ makevendortlv(uint32_t vendor, struct tlv *attr)
tlv2buf(v + 4, attr);
v[5] += 2; /* Vendor length increased for type and length fields. */
newtlv = maketlv(RAD_Attr_Vendor_Specific, l, v);
- if (newtlv == NULL)
- free(v);
- else
+ free(v);
+ if (newtlv)
freetlv(attr);
}
return newtlv;
@@ -1524,7 +1524,7 @@ int radsrv(struct request *rq) {
userascii = radattr2ascii(attr);
if (!userascii)
goto rmclrqexit;
- debug(DBG_DBG, "%s with username: %s", radmsgtype2string(msg->code), userascii);
+ debug(DBG_DBG, "radsrv: got %s (id %d) with username: %s from client %s (%s)", radmsgtype2string(msg->code), msg->id, userascii, from->conf->name, addr2string(from->addr));
/* will return with lock on the realm */
to = findserver(&realm, attr, msg->code == RAD_Accounting_Request);
@@ -1773,8 +1773,7 @@ void replyh(struct server *server, unsigned char *buf) {
if (ttlres == -1 && (options.addttl || from->conf->addttl))
addttlattr(msg, options.ttlattrtype, from->conf->addttl ? from->conf->addttl : options.addttl);
- debug(msg->code == RAD_Access_Accept || msg->code == RAD_Access_Reject || msg->code == RAD_Accounting_Response ? DBG_WARN : DBG_INFO,
- "replyh: passing %s to client %s (%s)", radmsgtype2string(msg->code), from->conf->name, addr2string(from->addr));
+ debug(DBG_DBG, "replyh: passing %s (id %d) to client %s (%s)", radmsgtype2string(msg->code), msg->id, from->conf->name, addr2string(from->addr));
radmsg_free(rqout->rq->msg);
rqout->rq->msg = msg;
@@ -1920,7 +1919,8 @@ void *clientwr(void *arg) {
for (i = 0; i < MAX_REQUESTS; i++) {
if (server->clientrdgone) {
- pthread_join(clientrdth, NULL);
+ if (conf->pdef->connecter)
+ pthread_join(clientrdth, NULL);
goto errexit;
}
@@ -2016,13 +2016,15 @@ void createlistener(uint8_t type, char *arg) {
debugerrno(errno, DBG_WARN, "createlistener: socket failed");
continue;
}
- setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+ if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) == -1)
+ debugerrno(errno, DBG_WARN, "createlistener: SO_REUSEADDR");
disable_DF_bit(s, res);
#ifdef IPV6_V6ONLY
if (res->ai_family == AF_INET6)
- setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on));
+ if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on)) == -1)
+ debugerrno(errno, DBG_WARN, "createlistener: IPV6_V6ONLY");
#endif
if (bind(s, res->ai_addr, res->ai_addrlen)) {
debugerrno(errno, DBG_WARN, "createlistener: bind failed");
@@ -3114,8 +3116,7 @@ int confserver_cb(struct gconffile **cf, void *arg, char *block, char *opt, char
if (resconf || !conf->dynamiclookupcommand) {
if (!compileserverconfig(conf, block))
- return 0; /* Don't goto errexit and free resconf -- it's
- * not ours to free. */
+ goto errexit;
}
if (!conf->secret) {
diff --git a/tlscommon.c b/tlscommon.c
index 3d27a35..ca0fa83 100644
--- a/tlscommon.c
+++ b/tlscommon.c
@@ -158,6 +158,7 @@ static int tlsaddcacrl(SSL_CTX *ctx, struct tls *conf) {
X509_STORE *x509_s;
unsigned long error;
+ SSL_CTX_set_cert_store(ctx, X509_STORE_new());
if (!SSL_CTX_load_verify_locations(ctx, conf->cacertfile, conf->cacertpath)) {
while ((error = ERR_get_error()))
debug(DBG_ERR, "SSL: %s", ERR_error_string(error, NULL));
diff --git a/util.c b/util.c
index dc36ed9..876cb6c 100644
--- a/util.c
+++ b/util.c
@@ -34,8 +34,10 @@ char *stringcopy(const char *s, int len) {
r = malloc(len + 1);
if (!r)
debug(DBG_ERR, "stringcopy: malloc failed");
- memcpy(r, s, len);
- r[len] = '\0';
+ else {
+ memcpy(r, s, len);
+ r[len] = '\0';
+ }
return r;
}
@@ -66,17 +68,17 @@ struct sockaddr *addr_copy(struct sockaddr *in) {
switch (in->sa_family) {
case AF_INET:
out = malloc(sizeof(struct sockaddr_in));
- if (out) {
- memset(out, 0, sizeof(struct sockaddr_in));
- ((struct sockaddr_in *)out)->sin_addr = ((struct sockaddr_in *)in)->sin_addr;
- }
+ if (out == NULL)
+ return NULL;
+ memset(out, 0, sizeof(struct sockaddr_in));
+ ((struct sockaddr_in *)out)->sin_addr = ((struct sockaddr_in *)in)->sin_addr;
break;
case AF_INET6:
out = malloc(sizeof(struct sockaddr_in6));
- if (out) {
- memset(out, 0, sizeof(struct sockaddr_in6));
- ((struct sockaddr_in6 *)out)->sin6_addr = ((struct sockaddr_in6 *)in)->sin6_addr;
- }
+ if (out == NULL)
+ return NULL;
+ memset(out, 0, sizeof(struct sockaddr_in6));
+ ((struct sockaddr_in6 *)out)->sin6_addr = ((struct sockaddr_in6 *)in)->sin6_addr;
break;
}
out->sa_family = in->sa_family;
@@ -148,10 +150,12 @@ int bindtoaddr(struct addrinfo *addrinfo, int family, int reuse, int v6only) {
disable_DF_bit(s,res);
if (reuse)
- setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+ if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) == -1)
+ debugerrno(errno, DBG_WARN, "Failed to set SO_REUSEADDR");
#ifdef IPV6_V6ONLY
if (v6only)
- setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on));
+ if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on)) == -1)
+ debugerrno(errno, DBG_INFO, "Failed to set IPV6_V6ONLY");
#endif
if (!bind(s, res->ai_addr, res->ai_addrlen))
return s;
@@ -167,7 +171,14 @@ int connectnonblocking(int s, const struct sockaddr *addr, socklen_t addrlen, st
socklen_t len;
origflags = fcntl(s, F_GETFL, 0);
- fcntl(s, F_SETFL, origflags | O_NONBLOCK);
+ if (origflags == -1) {
+ debugerrno(errno, DBG_WARN, "Failed to get flags");
+ return -1;
+ }
+ if (fcntl(s, F_SETFL, origflags | O_NONBLOCK) == -1) {
+ debugerrno(errno, DBG_WARN, "Failed to set O_NONBLOCK");
+ return -1;
+ }
if (!connect(s, addr, addrlen)) {
r = 0;
goto exit;
@@ -185,7 +196,8 @@ int connectnonblocking(int s, const struct sockaddr *addr, socklen_t addrlen, st
r = 0;
exit:
- fcntl(s, F_SETFL, origflags);
+ if (fcntl(s, F_SETFL, origflags) == -1)
+ debugerrno(errno, DBG_WARN, "Failed to set original flags back");
return r;
}
generated by cgit v1.1 at 2024-12-28 17:30:56 +0000