From: Alan T. DeKok <aland@freeradius.org>
Date: Thu, 23 Sep 2021 17:26:10 +0000 (-0400)
Subject: renew at 60% of PAC lifetime
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=96f433cc5126b8fa4cd505aca4f8c775ba370619;p=thirdparty%2Ffreeradius-server.git

renew at 60% of PAC lifetime
---

diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c b/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
index 7c0214f302..fec2b4f303 100644
--- a/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
+++ b/src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c
@@ -930,6 +930,8 @@ fr_radius_packet_code_t eap_fast_process(request_t *request, eap_session_t *eap_
 			t->mode = EAP_FAST_PROVISIONING_ANON;
 			t->pac.send = true;
 		} else {
+			fr_time_t renew;
+
 			if (SSL_session_reused(tls_session->ssl)) {
 				RDEBUG2("Session Resumed from PAC");
 				t->mode = EAP_FAST_NORMAL_AUTH;
@@ -939,11 +941,13 @@ fr_radius_packet_code_t eap_fast_process(request_t *request, eap_session_t *eap_
 			}
 
 			/*
-			 *	Send a new pac at ~0.6 times the lifetime.
+			 *	Send a new pac at 60% of the lifetime,
+			 *	or if the PAC has expired, or if no lifetime was set.
 			 */
-			if (fr_time_eq(t->pac.expires, fr_time_wrap(0)) || t->pac.expired ||
-			    fr_time_lteq(t->pac.expires,
-					 fr_time_add(request->packet->timestamp, t->pac_lifetime))) {
+			renew = fr_time_add(request->packet->timestamp, ((t->pac_lifetime * 3) / 5));
+
+			if (t->pac.expired || fr_time_eq(t->pac.expires, fr_time_wrap(0)) ||
+			     fr_time_lteq(t->pac.expires, renew)) {
 				t->pac.send = true;
 			}
 		}