rlm_radius: Add "originate" flag to suppress addition of Proxy-State attribute

diff --git a/raddb/mods-available/radius b/raddb/mods-available/radius
index 590f4063911844368ebb1d5e541170b1fc5d3deb..ce645b5dbcffe12f7a235fe35d5d5356f64db645 100644 (file)
--- a/raddb/mods-available/radius
+++ b/raddb/mods-available/radius
@@ -106,6 +106,17 @@ radius {
        #
 #      no_connection_fail = no
 
+       #
+       #  originate::
+       #
+       #  Sometimes we are creating a request that is not for the purpose of
+       #  proxying another request, in which case we do not want to add a
+       #  Proxy-State attribute.
+       #
+       #  In some cases, such as originating a CoA or Disconnect request,
+       #  including Proxy-State may confuse the receiving NAS.
+#      originate = no
+
        #
        #  status_checks { ... }:: For "are you alive?" queries.
        #

diff --git a/src/modules/rlm_radius/rlm_radius.c b/src/modules/rlm_radius/rlm_radius.c
index 6a3c990f943ff41b36df79d7ad182cf54714dcf6..854e623a83a8a83312b8c97a84a45730c5f024ac 100644 (file)
--- a/src/modules/rlm_radius/rlm_radius.c
+++ b/src/modules/rlm_radius/rlm_radius.c
@@ -128,6 +128,8 @@ static CONF_PARSER const module_config[] = {
 
        { FR_CONF_OFFSET("no_connection_fail", FR_TYPE_BOOL, rlm_radius_t, no_connection_fail) },
 
+       { FR_CONF_OFFSET("originate", FR_TYPE_BOOL, rlm_radius_t, originate) },
+
        { FR_CONF_POINTER("status_checks", FR_TYPE_SUBSECTION, NULL), .subcs = (void const *) status_checks_config },
 
        { FR_CONF_OFFSET("max_connections", FR_TYPE_UINT32, rlm_radius_t, max_connections), .dflt = STRINGIFY(32) },

diff --git a/src/modules/rlm_radius/rlm_radius.h b/src/modules/rlm_radius/rlm_radius.h
index f489dc3000069780c2e005b25617273a07a9e623..4aff8e25bd91301150187568389bd8ab5e1f1bac 100644 (file)
--- a/src/modules/rlm_radius/rlm_radius.h
+++ b/src/modules/rlm_radius/rlm_radius.h
@@ -86,6 +86,7 @@ struct rlm_radius_t {
        bool                    replicate;      //!< are we ignoring responses?
        bool                    synchronous;    //!< are we doing synchronous proxying?
        bool                    no_connection_fail; //!< are we failing immediately on no connection?
+       bool                    originate;  //!< are we originating packets rather than proxying?
 
        dl_module_inst_t                *io_submodule;  //!< As provided by the transport_parse
        fr_radius_client_io_t const *io;        //!< Easy access to the IO handle

diff --git a/src/modules/rlm_radius/rlm_radius_udp.c b/src/modules/rlm_radius/rlm_radius_udp.c
index 7bdb86ee82528ac9e6d76a084ec22e2c2085a286..34a685300f66b9a4b0d31d638b21bff9f20ff0bf 100644 (file)
--- a/src/modules/rlm_radius/rlm_radius_udp.c
+++ b/src/modules/rlm_radius/rlm_radius_udp.c
@@ -2020,7 +2020,9 @@ static int conn_write(fr_io_connection_t *c, fr_io_request_t *u)
        }
 
        /*
-        *      Add Proxy-State to the tail end of the packet.
+        *      Add Proxy-State to the tail end of the packet unless we are
+        *      originating the request.
+        *
         *      We need to add it here, and NOT in
         *      request->packet->vps, because multiple modules
         *      may be sending the packets at the same time.
@@ -2028,7 +2030,7 @@ static int conn_write(fr_io_connection_t *c, fr_io_request_t *u)
         *      Note that the length check will always pass, due to
         *      the buflen manipulation done above.
         */
-       if (proxy_state) {
+       if (proxy_state && !c->inst->parent->originate) {
                uint8_t         *attr = c->buffer + packet_len;
                VALUE_PAIR      *vp;
                vp_cursor_t     cursor;
@@ -2214,10 +2216,12 @@ static int conn_write(fr_io_connection_t *c, fr_io_request_t *u)
         *      checks.
         */
        if (u != radius->status_u) {
-               if (!c->inst->parent->synchronous) {
-                       RDEBUG("Proxying request.  Expecting response within %d.%06ds",
-                              u->timer.rt / USEC, u->timer.rt % USEC);
+               const char* action;
 
+               action = c->inst->parent->originate ? "Originating" : "Proxying";
+               if (!c->inst->parent->synchronous) {
+                       RDEBUG("%s request.  Expecting response within %d.%06ds",
+                              action, u->timer.rt / USEC, u->timer.rt % USEC);
                } else {
                        /*
                         *      If the packet doesn't get a response,
@@ -2229,7 +2233,7 @@ static int conn_write(fr_io_connection_t *c, fr_io_request_t *u)
                         *      request through a fail handler,
                         *      instead of just freeing it.
                         */
-                       RDEBUG("Proxying request.  Relying on NAS to perform retransmissions");
+                       RDEBUG("%s request.  Relying on NAS to perform retransmissions", action);
                }
 
                /*