From: Alan T. DeKok <aland@freeradius.org>
Date: Thu, 15 Feb 2018 18:05:29 +0000 (-0500)
Subject: remove NAT configuration for clients.
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9bfc0f4149cdb342ea787f4eeee7541348d59f79;p=thirdparty%2Ffreeradius-server.git

remove NAT configuration for clients.

Instead, if we have dynamic clients *and* we're using
connected sockets, THEN the clients should be connection-specific.

The remaining "todo" is to check for multiple packets from the
same source IP, but with different source ports... and to
track those separately.
---

diff --git a/share/dictionary.freeradius.internal b/share/dictionary.freeradius.internal
index d7c8dacf1c7..7a39841dcf7 100644
--- a/share/dictionary.freeradius.internal
+++ b/share/dictionary.freeradius.internal
@@ -259,7 +259,6 @@ ATTRIBUTE	FreeRADIUS-Response-Delay		1152	integer
 ATTRIBUTE	FreeRADIUS-Client-Src-IP-Address	1153	ipaddr
 ATTRIBUTE	FreeRADIUS-Client-Src-IPv6-Address	1154	ipv6addr
 ATTRIBUTE	FreeRADIUS-Response-Delay-USec		1155	integer
-ATTRIBUTE	FreeRADIUS-Client-Behind-NAT		1156	bool
 
 ATTRIBUTE	REST-HTTP-Header			1160	string
 ATTRIBUTE	REST-HTTP-Body				1161	string
diff --git a/src/include/clients.h b/src/include/clients.h
index 803af8226b6..505a49fd693 100644
--- a/src/include/clients.h
+++ b/src/include/clients.h
@@ -50,8 +50,6 @@ typedef struct radclient {
 	bool			active;			//!< for dynamic clients
 	bool			negative;		//!< negative cache entry
 	bool			expired;		//!< has it expired?
-	bool			is_nat;			//!< is this client a NATed one?
-	bool			behind_nat;		//!< is the dynamic client behind a NAT?
 
 #ifdef WITH_TLS
 	bool			tls_required;		//!< whether TLS encryption is required.
diff --git a/src/main/client.c b/src/main/client.c
index c2d0591007c..e87f9a9be8b 100644
--- a/src/main/client.c
+++ b/src/main/client.c
@@ -196,11 +196,6 @@ bool client_add(RADCLIENT_LIST *clients, RADCLIENT *client)
 
 	if (!client) return false;
 
-	if (client->behind_nat) {
-		ERROR("Clients cannot be defined to be behind a NAT.");
-		return false;
-	}
-
 	/*
 	 *	Hack to fixup wildcard clients
 	 *
@@ -454,11 +449,6 @@ static const CONF_PARSER client_config[] = {
 	{ FR_CONF_OFFSET("virtual_server", FR_TYPE_STRING, RADCLIENT, server) },
 	{ FR_CONF_OFFSET("response_window", FR_TYPE_TIMEVAL, RADCLIENT, response_window) },
 
-	/*
-	 *	This should only be set for dynamic clients.
-	 */
-	{ FR_CONF_OFFSET("behind_nat", FR_TYPE_BOOL, RADCLIENT, behind_nat) },
-
 #ifdef WITH_TCP
 	{ FR_CONF_POINTER("proto", FR_TYPE_STRING, &hs_proto) },
 	{ FR_CONF_POINTER("limit", FR_TYPE_SUBSECTION, NULL), .subcs = (void const *) limit_config },
@@ -977,15 +967,6 @@ RADCLIENT *client_afrom_request(TALLOC_CTX *ctx, REQUEST *request)
 			value = vp->vp_strvalue;
 			break;
 
-		case FR_FREERADIUS_CLIENT_BEHIND_NAT:
-			attr = "behind_nat";
-			if (vp->vp_bool) {
-				value = "yes";
-			} else {
-				value = "no";
-			}
-			break;
-
 		default:
 			RERROR("Ignoring attribute %s", vp->da->name);
 			continue;
diff --git a/src/modules/proto_radius/proto_radius_udp.c b/src/modules/proto_radius/proto_radius_udp.c
index e47482fee91..775df6a0b5f 100644
--- a/src/modules/proto_radius/proto_radius_udp.c
+++ b/src/modules/proto_radius/proto_radius_udp.c
@@ -326,15 +326,6 @@ static ssize_t mod_encode(void const *instance, REQUEST *request, uint8_t *buffe
 		return 1;
 	}
 
-	/*
-	 *	If we're not using connected sockets, we can't have
-	 *	clients behind a NAT.
-	 */
-	if (!inst->use_connected) {
-		client->is_nat = false;
-		client->behind_nat = false;
-	}
-
 	memcpy(buffer, &client, sizeof(client));
 	return sizeof(client);
 }
@@ -1102,18 +1093,6 @@ static ssize_t mod_read(void *instance, void **packet_ctx, fr_time_t **recv_time
 		return 0;
 	}
 
-	/*
-	 *	We can only do NAT gateways if we're using connected
-	 *	sockets.  This code catches *statically* defined
-	 *	clients, not dynamic ones.
-	 */
-	if (!inst->use_connected && (address.client->is_nat || address.client->behind_nat)) {
-		WARN("Ignoring NAT settings for client %s as we are not using connected sockets for listener %s",
-			address.client->shortname, inst->name);
-		address.client->is_nat = false;
-		address.client->behind_nat = false;
-	}
-
 	/*
 	 *	Check for a socket that SHOULD be connected.  If so,
 	 *	either create the socket, OR find it in the list of
@@ -1143,16 +1122,6 @@ static ssize_t mod_read(void *instance, void **packet_ctx, fr_time_t **recv_time
 			PTHREAD_MUTEX_UNLOCK(&inst->master.mutex);
 		}
 
-		/*
-		 *	This dynamic client is behind a NAT.  We've
-		 *	read all of the outstanding packets for it, so
-		 *	we just delete the client now.
-		 */
-		if (address.client->dynamic && address.client->behind_nat &&
-		    (address.client->received == 0)) {
-			talloc_free(address.client);
-		}
-
 		/*
 		 *	We're no longer tracking this packet.
 		 *	Instead, the child socket is.  So we just