Add the client's TLS alert number as an attribute

diff --git a/share/dictionary.freeradius.internal b/share/dictionary.freeradius.internal
index 6852b1066c87487de51b607c2e70259571c53719..a0c45e34bb570575615bcca20b788900c55cd96e 100644 (file)
--- a/share/dictionary.freeradius.internal
+++ b/share/dictionary.freeradius.internal
@@ -699,6 +699,45 @@ ATTRIBUTE  TLS-OCSP-Response                       1945    octets
 #      so that the SoH radius request can be proxied, but from which
 #      vendor? Sigh...
 #
+
+ATTRIBUTE      TLS-Client-Error-Code                   1946    uint8
+
+VALUE          TLS-Client-Error-Code   Close-Notify                    0
+VALUE          TLS-Client-Error-Code   End-Of-Early-Data               1
+VALUE          TLS-Client-Error-Code   Unexpected-Message              10
+VALUE          TLS-Client-Error-Code   Bad-Record-Mac                  20
+VALUE          TLS-Client-Error-Code   Decryption-Failed               21
+VALUE          TLS-Client-Error-Code   Record-Overflow                 22
+VALUE          TLS-Client-Error-Code   Decompression-Failure           30
+VALUE          TLS-Client-Error-Code   Handshake-Failure               40
+VALUE          TLS-Client-Error-Code   No-Certificate                  41
+VALUE          TLS-Client-Error-Code   Bad-Certificate                 42
+VALUE          TLS-Client-Error-Code   Unsupported-Certificate         43
+VALUE          TLS-Client-Error-Code   Certificate-Revoked             44
+VALUE          TLS-Client-Error-Code   Certificate-Expired             45
+VALUE          TLS-Client-Error-Code   Certificate-Unknown             46
+VALUE          TLS-Client-Error-Code   Illegal-Parameter               47
+VALUE          TLS-Client-Error-Code   Unknown-CA                      48
+VALUE          TLS-Client-Error-Code   Access-Denied                   49
+VALUE          TLS-Client-Error-Code   Decode-Error                    50
+VALUE          TLS-Client-Error-Code   Decrypt-Error                   51
+VALUE          TLS-Client-Error-Code   Export-Restriction              60
+VALUE          TLS-Client-Error-Code   Protocol-Version                70
+VALUE          TLS-Client-Error-Code   Insufficient-Security           71
+VALUE          TLS-Client-Error-Code   Internal-Error                  80
+VALUE          TLS-Client-Error-Code   Inappropriate-Fallback          86
+VALUE          TLS-Client-Error-Code   User-Cancelled                  90
+VALUE          TLS-Client-Error-Code   No-Renegotiation                100
+VALUE          TLS-Client-Error-Code   Missing-Extension               109
+VALUE          TLS-Client-Error-Code   Unsupported-Extension           110
+VALUE          TLS-Client-Error-Code   Certificate-Unobtainable        111
+VALUE          TLS-Client-Error-Code   Unrecognized-Name               112
+VALUE          TLS-Client-Error-Code   Bad-Certificate-Status-Response 113
+VALUE          TLS-Client-Error-Code   Bad-Certificate-Hash-Value      114
+VALUE          TLS-Client-Error-Code   Unknown-PSK-Identity            115
+VALUE          TLS-Client-Error-Code   Certificate-Required            116
+VALUE          TLS-Client-Error-Code   No-Application-Protocol         120
+
 ATTRIBUTE      SoH-MS-Machine-OS-vendor                2100    integer
 VALUE  SoH-MS-Machine-OS-vendor        Microsoft               311
 

diff --git a/src/lib/tls/session.c b/src/lib/tls/session.c
index 3bd9e77d9fa9bc54942f5fd5e247acae84edc01e..c72e6a7f9300084786c5d3b56359abcb80d19939 100644 (file)
--- a/src/lib/tls/session.c
+++ b/src/lib/tls/session.c
@@ -340,6 +340,10 @@ void tls_session_info_cb(SSL const *ssl, int where, int ret)
                if ((ret & 0xff) == SSL_AD_CLOSE_NOTIFY) return;
 
                if (where & SSL_CB_READ) {
+                       TALLOC_CTX      *ctx;
+                       VALUE_PAIR      **list;
+                       fr_value_box_t  value;
+
                        REDEBUG("Client sent %s TLS alert: %s", SSL_alert_type_string_long(ret),
                                SSL_alert_desc_string_long(ret));
 
@@ -354,9 +358,23 @@ void tls_session_info_cb(SSL const *ssl, int where, int ret)
                        default:
                                break;
                        }
+
+                       RADIUS_LIST_AND_CTX(ctx, list, request, REQUEST_CURRENT, PAIR_LIST_REQUEST);
+
+                       memset(&value, 0, sizeof(value));
+                       value.type = FR_TYPE_UINT8;
+                       value.vb_uint8 = ret & 0xff;
+                       value.enumv = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), FR_TLS_CLIENT_ERROR_CODE);
+
+                       if (!list || (fr_pair_update_by_num(ctx, list, 0,
+                           FR_TLS_CLIENT_ERROR_CODE, TAG_ANY, &value) < 0)) {
+                               RWDEBUG("Failed updating &TLS-Client-Error-Code");
+                       } else {
+                               RDEBUG2("&TLS-Client-Error-Code := %pV", &value);
+                       }
                } else {
                        REDEBUG("Sending client %s TLS alert: %s %i", SSL_alert_type_string_long(ret),
-                              SSL_alert_desc_string_long(ret), ret & 0xff);
+                               SSL_alert_desc_string_long(ret), ret & 0xff);
                }
                return;
        }