remove NAT configuration for clients.

Instead, if we have dynamic clients *and* we're using
connected sockets, THEN the clients should be connection-specific.

The remaining "todo" is to check for multiple packets from the
same source IP, but with different source ports... and to
track those separately.

diff --git a/share/dictionary.freeradius.internal b/share/dictionary.freeradius.internal
index d7c8dacf1c72f2aea6248be1ef23cd09e9ae077d..7a39841dcf737139da75ec0460b06f954c2b5329 100644 (file)
--- a/share/dictionary.freeradius.internal
+++ b/share/dictionary.freeradius.internal
@@ -259,7 +259,6 @@ ATTRIBUTE   FreeRADIUS-Response-Delay               1152    integer
 ATTRIBUTE      FreeRADIUS-Client-Src-IP-Address        1153    ipaddr
 ATTRIBUTE      FreeRADIUS-Client-Src-IPv6-Address      1154    ipv6addr
 ATTRIBUTE      FreeRADIUS-Response-Delay-USec          1155    integer
-ATTRIBUTE      FreeRADIUS-Client-Behind-NAT            1156    bool
 
 ATTRIBUTE      REST-HTTP-Header                        1160    string
 ATTRIBUTE      REST-HTTP-Body                          1161    string

diff --git a/src/include/clients.h b/src/include/clients.h
index 803af8226b675c288b9cac8e6bfaacef0cddc7ba..505a49fd693c420921e716e341bb5e979cf3950c 100644 (file)
--- a/src/include/clients.h
+++ b/src/include/clients.h
@@ -50,8 +50,6 @@ typedef struct radclient {
        bool                    active;                 //!< for dynamic clients
        bool                    negative;               //!< negative cache entry
        bool                    expired;                //!< has it expired?
-       bool                    is_nat;                 //!< is this client a NATed one?
-       bool                    behind_nat;             //!< is the dynamic client behind a NAT?
 
 #ifdef WITH_TLS
        bool                    tls_required;           //!< whether TLS encryption is required.

diff --git a/src/main/client.c b/src/main/client.c
index c2d0591007c8bcc7322d5d3c6ddbbffc0840e0ae..e87f9a9be8bbe3640e07ba58bdc09a36ba5799b2 100644 (file)
--- a/src/main/client.c
+++ b/src/main/client.c
@@ -196,11 +196,6 @@ bool client_add(RADCLIENT_LIST *clients, RADCLIENT *client)
 
        if (!client) return false;
 
-       if (client->behind_nat) {
-               ERROR("Clients cannot be defined to be behind a NAT.");
-               return false;
-       }
-
        /*
         *      Hack to fixup wildcard clients
         *
@@ -454,11 +449,6 @@ static const CONF_PARSER client_config[] = {
        { FR_CONF_OFFSET("virtual_server", FR_TYPE_STRING, RADCLIENT, server) },
        { FR_CONF_OFFSET("response_window", FR_TYPE_TIMEVAL, RADCLIENT, response_window) },
 
-       /*
-        *      This should only be set for dynamic clients.
-        */
-       { FR_CONF_OFFSET("behind_nat", FR_TYPE_BOOL, RADCLIENT, behind_nat) },
-
 #ifdef WITH_TCP
        { FR_CONF_POINTER("proto", FR_TYPE_STRING, &hs_proto) },
        { FR_CONF_POINTER("limit", FR_TYPE_SUBSECTION, NULL), .subcs = (void const *) limit_config },
@@ -977,15 +967,6 @@ RADCLIENT *client_afrom_request(TALLOC_CTX *ctx, REQUEST *request)
                        value = vp->vp_strvalue;
                        break;
 
-               case FR_FREERADIUS_CLIENT_BEHIND_NAT:
-                       attr = "behind_nat";
-                       if (vp->vp_bool) {
-                               value = "yes";
-                       } else {
-                               value = "no";
-                       }
-                       break;
-
                default:
                        RERROR("Ignoring attribute %s", vp->da->name);
                        continue;

diff --git a/src/modules/proto_radius/proto_radius_udp.c b/src/modules/proto_radius/proto_radius_udp.c
index e47482fee91f0714487d9a423c6b4867f5ea83b2..775df6a0b5fe4c18da75747c56d635669c79f9f2 100644 (file)
--- a/src/modules/proto_radius/proto_radius_udp.c
+++ b/src/modules/proto_radius/proto_radius_udp.c
@@ -326,15 +326,6 @@ static ssize_t mod_encode(void const *instance, REQUEST *request, uint8_t *buffe
                return 1;
        }
 
-       /*
-        *      If we're not using connected sockets, we can't have
-        *      clients behind a NAT.
-        */
-       if (!inst->use_connected) {
-               client->is_nat = false;
-               client->behind_nat = false;
-       }
-
        memcpy(buffer, &client, sizeof(client));
        return sizeof(client);
 }
@@ -1102,18 +1093,6 @@ static ssize_t mod_read(void *instance, void **packet_ctx, fr_time_t **recv_time
                return 0;
        }
 
-       /*
-        *      We can only do NAT gateways if we're using connected
-        *      sockets.  This code catches *statically* defined
-        *      clients, not dynamic ones.
-        */
-       if (!inst->use_connected && (address.client->is_nat || address.client->behind_nat)) {
-               WARN("Ignoring NAT settings for client %s as we are not using connected sockets for listener %s",
-                       address.client->shortname, inst->name);
-               address.client->is_nat = false;
-               address.client->behind_nat = false;
-       }
-
        /*
         *      Check for a socket that SHOULD be connected.  If so,
         *      either create the socket, OR find it in the list of
@@ -1143,16 +1122,6 @@ static ssize_t mod_read(void *instance, void **packet_ctx, fr_time_t **recv_time
                        PTHREAD_MUTEX_UNLOCK(&inst->master.mutex);
                }
 
-               /*
-                *      This dynamic client is behind a NAT.  We've
-                *      read all of the outstanding packets for it, so
-                *      we just delete the client now.
-                */
-               if (address.client->dynamic && address.client->behind_nat &&
-                   (address.client->received == 0)) {
-                       talloc_free(address.client);
-               }
-
                /*
                 *      We're no longer tracking this packet.
                 *      Instead, the child socket is.  So we just