From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Mon, 26 Mar 2018 13:00:19 +0000 (+0100)
Subject: Add the client's TLS alert number as an attribute
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=be4e29f86c7e8a8e618d5d0af034bc3e0e5b6db5;p=thirdparty%2Ffreeradius-server.git

Add the client's TLS alert number as an attribute
---

diff --git a/share/dictionary.freeradius.internal b/share/dictionary.freeradius.internal
index 6852b1066c8..a0c45e34bb5 100644
--- a/share/dictionary.freeradius.internal
+++ b/share/dictionary.freeradius.internal
@@ -699,6 +699,45 @@ ATTRIBUTE	TLS-OCSP-Response			1945	octets
 #	so that the SoH radius request can be proxied, but from which
 #	vendor? Sigh...
 #
+
+ATTRIBUTE	TLS-Client-Error-Code			1946	uint8
+
+VALUE		TLS-Client-Error-Code	Close-Notify			0
+VALUE		TLS-Client-Error-Code	End-Of-Early-Data		1
+VALUE		TLS-Client-Error-Code	Unexpected-Message		10
+VALUE		TLS-Client-Error-Code	Bad-Record-Mac			20
+VALUE		TLS-Client-Error-Code	Decryption-Failed		21
+VALUE		TLS-Client-Error-Code	Record-Overflow			22
+VALUE		TLS-Client-Error-Code	Decompression-Failure		30
+VALUE		TLS-Client-Error-Code	Handshake-Failure		40
+VALUE		TLS-Client-Error-Code	No-Certificate			41
+VALUE		TLS-Client-Error-Code	Bad-Certificate			42
+VALUE		TLS-Client-Error-Code	Unsupported-Certificate		43
+VALUE		TLS-Client-Error-Code	Certificate-Revoked		44
+VALUE		TLS-Client-Error-Code	Certificate-Expired		45
+VALUE		TLS-Client-Error-Code	Certificate-Unknown		46
+VALUE		TLS-Client-Error-Code	Illegal-Parameter		47
+VALUE		TLS-Client-Error-Code	Unknown-CA			48
+VALUE		TLS-Client-Error-Code	Access-Denied			49
+VALUE		TLS-Client-Error-Code	Decode-Error			50
+VALUE		TLS-Client-Error-Code	Decrypt-Error			51
+VALUE		TLS-Client-Error-Code	Export-Restriction		60
+VALUE		TLS-Client-Error-Code	Protocol-Version		70
+VALUE		TLS-Client-Error-Code	Insufficient-Security		71
+VALUE		TLS-Client-Error-Code	Internal-Error			80
+VALUE		TLS-Client-Error-Code	Inappropriate-Fallback		86
+VALUE		TLS-Client-Error-Code	User-Cancelled			90
+VALUE		TLS-Client-Error-Code	No-Renegotiation		100
+VALUE		TLS-Client-Error-Code	Missing-Extension		109
+VALUE		TLS-Client-Error-Code	Unsupported-Extension		110
+VALUE		TLS-Client-Error-Code	Certificate-Unobtainable	111
+VALUE		TLS-Client-Error-Code	Unrecognized-Name		112
+VALUE		TLS-Client-Error-Code	Bad-Certificate-Status-Response	113
+VALUE		TLS-Client-Error-Code	Bad-Certificate-Hash-Value	114
+VALUE		TLS-Client-Error-Code	Unknown-PSK-Identity		115
+VALUE		TLS-Client-Error-Code	Certificate-Required		116
+VALUE		TLS-Client-Error-Code	No-Application-Protocol		120
+
 ATTRIBUTE	SoH-MS-Machine-OS-vendor		2100	integer
 VALUE	SoH-MS-Machine-OS-vendor	Microsoft		311
 
diff --git a/src/lib/tls/session.c b/src/lib/tls/session.c
index 3bd9e77d9fa..c72e6a7f930 100644
--- a/src/lib/tls/session.c
+++ b/src/lib/tls/session.c
@@ -340,6 +340,10 @@ void tls_session_info_cb(SSL const *ssl, int where, int ret)
 		if ((ret & 0xff) == SSL_AD_CLOSE_NOTIFY) return;
 
 		if (where & SSL_CB_READ) {
+			TALLOC_CTX	*ctx;
+			VALUE_PAIR	**list;
+			fr_value_box_t	value;
+
 			REDEBUG("Client sent %s TLS alert: %s", SSL_alert_type_string_long(ret),
 			        SSL_alert_desc_string_long(ret));
 
@@ -354,9 +358,23 @@ void tls_session_info_cb(SSL const *ssl, int where, int ret)
 			default:
 				break;
 			}
+
+			RADIUS_LIST_AND_CTX(ctx, list, request, REQUEST_CURRENT, PAIR_LIST_REQUEST);
+
+			memset(&value, 0, sizeof(value));
+			value.type = FR_TYPE_UINT8;
+			value.vb_uint8 = ret & 0xff;
+			value.enumv = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), FR_TLS_CLIENT_ERROR_CODE);
+
+			if (!list || (fr_pair_update_by_num(ctx, list, 0,
+			    FR_TLS_CLIENT_ERROR_CODE, TAG_ANY, &value) < 0)) {
+				RWDEBUG("Failed updating &TLS-Client-Error-Code");
+			} else {
+				RDEBUG2("&TLS-Client-Error-Code := %pV", &value);
+			}
 		} else {
 			REDEBUG("Sending client %s TLS alert: %s %i", SSL_alert_type_string_long(ret),
-			       SSL_alert_desc_string_long(ret), ret & 0xff);
+				SSL_alert_desc_string_long(ret), ret & 0xff);
 		}
 		return;
 	}