From: Alan T. DeKok <aland@freeradius.org>
Date: Mon, 29 Jul 2019 01:09:42 +0000 (-0400)
Subject: warn in debug mode if there may be a proxy loop
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ebaea99fd69175ea3f3ab49be05382b4e4a49423;p=thirdparty%2Ffreeradius-server.git

warn in debug mode if there may be a proxy loop
---

diff --git a/src/modules/rlm_radius/rlm_radius_udp.c b/src/modules/rlm_radius/rlm_radius_udp.c
index 98a55514def..9205f1e8e6b 100644
--- a/src/modules/rlm_radius/rlm_radius_udp.c
+++ b/src/modules/rlm_radius/rlm_radius_udp.c
@@ -2024,9 +2024,33 @@ static int conn_write(fr_io_connection_t *c, fr_io_request_t *u)
 	if (proxy_state) {
 		uint8_t		*attr = c->buffer + packet_len;
 		VALUE_PAIR	*vp;
+		vp_cursor_t	cursor;
+		int		count;
 
 		rad_assert((size_t) (packet_len + proxy_state) <= c->buflen);
 
+		/*
+		 *	Count how many Proxy-State attributes have
+		 *	*our* magic number.
+		 */
+		if (fr_debug_lvl) {
+			count = 0;
+			(void) fr_pair_cursor_init(&cursor, &request->packet->vps);
+			while ((vp = fr_pair_cursor_next_by_da(&cursor, attr_proxy_state, TAG_ANY)) != NULL) {
+				if ((vp->vp_length == 4) && (memcmp(vp->vp_octets, &c->inst->parent->proxy_state, 4) == 0)) {
+					count++;
+				}
+			}
+
+			/*
+			 *	Some configurations may proxy to
+			 *	ourselves for tests / simplicity.  But
+			 *	warn if there are a large number of
+			 *	identical Proxy-State attributes.
+			 */
+			if (count > 4) RWARN("Potential proxy loop detected!  Please recheck your configuration.");
+		}
+
 		attr[0] = (uint8_t)attr_proxy_state->attr;
 		attr[1] = 6;
 		memcpy(attr + 2, &c->inst->parent->proxy_state, 4);