From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Fri, 9 Apr 2021 23:35:09 +0000 (+0100)
Subject: Discard the child state when processing NAK
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e967562740b6857bec66c1ac0a3eea658455f306;p=thirdparty%2Ffreeradius-server.git

Discard the child state when processing NAK
---

diff --git a/src/lib/server/state.c b/src/lib/server/state.c
index 50824366e7a..12aaa1ce37e 100644
--- a/src/lib/server/state.c
+++ b/src/lib/server/state.c
@@ -855,6 +855,32 @@ void fr_state_restore_to_child(request_t *child, void const *unique_ptr, int uni
 	talloc_free(child_entry);
 }
 
+/** Remove state from a child
+ *
+ * This is useful for modules like EAP, where we keep a persistent eap_session
+ * but may call multiple EAP method modules during negotiation, and need to
+ * discard the state between each module call.
+ *
+ * @param[in] parent		Holding the child's state.
+ * @param[in] unique_ptr	A parent may have multiple subrequests spawned
+ *				by different modules.  This identifies the module
+ *      			or other facility that spawned the subrequest.
+ * @param[in] unique_int	Further identification.
+ */
+void fr_state_discard_child(request_t *parent, void const *unique_ptr, int unique_int)
+{
+	state_child_entry_t	*child_entry;
+	request_t		*request = parent; /* Stupid logging */
+
+	child_entry = request_data_get(parent, unique_ptr, unique_int);
+	if (!child_entry) {
+		RDEBUG3("No child state found in parent %s", parent->name);
+		return;
+	}
+
+	talloc_free(child_entry);
+}
+
 /** Return number of entries created
  *
  */
diff --git a/src/lib/server/state.h b/src/lib/server/state.h
index 64bbbddf5f4..367b70ec104 100644
--- a/src/lib/server/state.h
+++ b/src/lib/server/state.h
@@ -45,7 +45,9 @@ int	fr_state_to_request(fr_state_tree_t *state, request_t *request);
 int	fr_request_to_state(fr_state_tree_t *state, request_t *request);
 
 void	fr_state_store_in_parent(request_t *request, void const *unique_ptr, int unique_int);
-void	fr_state_restore_to_child(request_t *request, void const *unique_ptr, int unique_int);
+void	fr_state_restore_to_child(request_t *child, void const *unique_ptr, int unique_int);
+void	fr_state_discard_child(request_t *parent, void const *unique_ptr, int unique_int);
+
 /*
  *	Stats
  */
diff --git a/src/modules/rlm_eap/rlm_eap.c b/src/modules/rlm_eap/rlm_eap.c
index 944a08453bc..75f9db174e0 100644
--- a/src/modules/rlm_eap/rlm_eap.c
+++ b/src/modules/rlm_eap/rlm_eap.c
@@ -569,6 +569,7 @@ static unlang_action_t eap_method_select(rlm_rcode_t *p_result, module_ctx_t con
 		 *	the memory it alloced.
 		 */
 		TALLOC_FREE(eap_session->opaque);
+		fr_state_discard_child(eap_session->request, eap_session, 0);
 		next = eap_process_nak(mctx, eap_session->request, eap_session->type, type);
 		if (!next) RETURN_MODULE_REJECT;