[PATCH 0/4] RADIUS/TLS with several messages in flight

[Andrei-Alexandru Bleortu]

hostapd's RADIUS/TLS client lost responses whenever two of them reached
it together, as they do when several requests are outstanding: on two
access points with RADIUS over TLS to FreeRADIUS, accounting connections
failed every few minutes with "decryption failed or bad record mac" and
"No response from Accounting server - failover". The debug log showed
the sequence each time: two Accounting-Requests sent back to back, both
responses read at once (84 bytes, two records), one processed, and the
next request's encryption discarding the other, after which the next
record failed its MAC check.

1: the OpenSSL wrapper stops resetting the receive BIO when encrypting
   and decrypts every complete record, not just the first.
2: the RADIUS client frames the decrypted stream by the RADIUS Length
   field (RFC 6614, 3.4), so several messages in one chunk, or one
   message across chunks, are all processed.
3: a message queued during the TLS handshake is no longer counted as a
   request plus a timeout and a retransmission, which also brought
   failover one attempt closer.
4: hwsim tests with a RADIUS/TLS server that sends its responses in
   separate records of one segment, in a single record, and with a
   record split around a new request; they fail on current main and
   pass with 1-3, with no retransmission. The hwsim hostapd build gains CONFIG_RADIUS_TLS (the
   existing RADIUS/TLS test also needs a local FreeRADIUS, so the path
   was not exercised).

The ap_eap, eap, eap_proto, radius, suite_b, authsrv, ieee8021x,
cert_check, erp and tnc modules pass with patches 1-2 and 4 as on main;
the radius module passes with the whole series. Patches 1-2 also run on
the two access points above.

Andrei-Alexandru Bleortu (4):
  OpenSSL: Keep pending received TLS data when encrypting
  RADIUS client: Frame RADIUS/TLS messages by their length
  RADIUS client: Count a message only once it is sent
  tests: RADIUS/TLS accounting responses coalesced and split

 src/crypto/tls_openssl.c           |  43 +++--
 src/radius/radius_client.c         | 286 ++++++++++++++++++-----------
 tests/hwsim/example-hostapd.config |   1 +
 tests/hwsim/test_radius.py         | 185 +++++++++++++++++++
 4 files changed, 391 insertions(+), 124 deletions(-)

-- 
2.47.3