run new connections through a special section

in order to clearly separate them from other packets

diff --git a/raddb/sites-available/default b/raddb/sites-available/default
index d46c72a871c7488e5a7e11f1de0f88f3c8601829..30161087c7afd74014a0ef5ec87cbe77326ac1da 100644 (file)
--- a/raddb/sites-available/default
+++ b/raddb/sites-available/default
@@ -467,6 +467,23 @@ authorize {
 #      Autz-Type Status-Server {
 #
 #      }
+
+       #
+       #  RADIUS/TLS (or RadSec) connections are processed through
+       #  this section.  See sites-available/tls, and the configuration
+       #  item "check_client_connections" for more information.
+       #
+       #  The request contains TLS client certificate attributes,
+       #  and nothing else.  The debug output will print which
+       #  attributes are available on your system.
+       #
+       #  If the section returns "ok" or "updated", then the
+       #  connection is accepted.  Otherwise the connection is
+       #  terminated.
+       #
+       Autz-Type New-TLS-Connection {
+                 ok
+       }
 }
 
 

diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls
index 0bda75f42c0667ee8989c08870b1895a321918cb..8c8e06ac4bfff70790b2ff829891cdea37500e60 100644 (file)
--- a/raddb/sites-available/tls
+++ b/raddb/sites-available/tls
@@ -64,6 +64,24 @@ listen {
 
        clients = radsec
 
+       #
+       #  When this is set to "yes", new TLS connections
+       #  are processed through a section called
+       #
+       #       Autz-Type New-TLS-Connection {
+       #                 ...
+       #       }
+       #
+       #  The request contains TLS client certificate attributes,
+       #  and nothing else.  The debug output will print which
+       #  attributes are available on your system.
+       #
+       #  If the section returns "ok" or "updated", then the
+       #  connection is accepted.  Otherwise the connection is
+       #  terminated.
+       #
+#      check_client_connections = yes
+
        #
        #  Connection limiting for sockets with "proto = tcp".
        #

diff --git a/src/main/listen.c b/src/main/listen.c
index 3919354aeb175114a3a75bbcd11c71a6750417e4..6ef912c003679335edc0a31f0d8141d0c907e41b 100644 (file)
--- a/src/main/listen.c
+++ b/src/main/listen.c
@@ -364,6 +364,33 @@ int rad_status_server(REQUEST *request)
        int rcode = RLM_MODULE_OK;
        DICT_VALUE *dval;
 
+#ifdef WITH_TLS
+       if (request->listener->tls) {
+               listen_socket_t *sock = request->listener->data;
+
+               if (sock->state == LISTEN_TLS_CHECKING) {
+                       RDEBUG("Checking TLS connection to see if it is authorized.");
+
+                       dval = dict_valbyname(PW_AUTZ_TYPE, 0, "New-TLS-Connection");
+                       if (dval) {
+                               rcode = process_authorize(dval->value, request);
+                       } else {
+                               rcode = RLM_MODULE_OK;
+                               RWDEBUG("Did not find 'Autz-Type New-TLS-Connection' - defaulting to accept");
+                       }
+
+                       if ((rcode == RLM_MODULE_OK) || (rcode == RLM_MODULE_UPDATED)) {
+                               request->reply->code = PW_CODE_ACCESS_ACCEPT;
+                       } else {
+                               request->reply->code = PW_CODE_ACCESS_REJECT;
+                       }
+
+                       return 0;
+               }
+       }
+#endif
+
+
        switch (request->listener->type) {
 #ifdef WITH_STATS
        case RAD_LISTEN_NONE:

diff --git a/src/main/tls_listen.c b/src/main/tls_listen.c
index ec59e963dffa7bd4bbdba96320a2ed7da0a81cf9..f0eaf62dfe8437960a666d298df0a95ea48a755d 100644 (file)
--- a/src/main/tls_listen.c
+++ b/src/main/tls_listen.c
@@ -282,9 +282,7 @@ check_for_setup:
                        goto get_application_data;
                }
 
-               RDEBUG("Checking initial connection");
                request->packet->vps = fr_pair_list_copy(request->packet, sock->certs);
-               rdebug_pair_list(L_DBG_LVL_1, request, request->packet->vps, "&request:");
 
                /*
                 *      Fake out a Status-Server packet, which