enforce max request lifetime on the child request

diff --git a/share/dictionary.freeradius.internal b/share/dictionary.freeradius.internal
index f5cc048851ed24a5bf278da745a4c39adb5c9864..e24bbd924094858cd3c18eaa6025b940c92cddc2 100644 (file)
--- a/share/dictionary.freeradius.internal
+++ b/share/dictionary.freeradius.internal
@@ -439,6 +439,12 @@ VALUE      Listen-Socket-Type              coa                     8
 
 ATTRIBUTE      Outer-Realm-Name                        1251    string
 ATTRIBUTE      Inner-Realm-Name                        1252    string
+ATTRIBUTE      Request-Lifetime                        1253    integer
+
+#
+#      Range:  1254 - 1279
+#              Unused
+#
 
 #
 #      Range:  1280 - 1535

diff --git a/src/main/unlang_interpret.c b/src/main/unlang_interpret.c
index 63581791fb64ba1b8d8ebbcc41f59a5410e06b11..af3970245fe027a199f5cb4d92f6c83b22aa0a36 100644 (file)
--- a/src/main/unlang_interpret.c
+++ b/src/main/unlang_interpret.c
@@ -680,9 +680,20 @@ static rlm_rcode_t unlang_subrequest_resume(UNUSED REQUEST *request, unlang_stac
        return RLM_MODULE_YIELD;
 }
 
+
+static void unlang_max_request_time(UNUSED fr_event_list_t *el, UNUSED struct timeval *now, void *uctx)
+{
+       REQUEST *request = talloc_get_type_abort(uctx, REQUEST);
+
+       RDEBUG("Reached Request-Lifetime.  Forcibly stopping request");
+       talloc_free(request);
+}
+
+
 static unlang_action_t unlang_detach(REQUEST *request, unlang_stack_t *stack,
                                     rlm_rcode_t *presult, int *priority)
 {
+       VALUE_PAIR              *vp;
        unlang_stack_frame_t    *frame = &stack->frame[stack->depth];
        unlang_t                *instruction = frame->instruction;
 
@@ -696,6 +707,37 @@ static unlang_action_t unlang_detach(REQUEST *request, unlang_stack_t *stack,
                return UNLANG_ACTION_CALCULATE_RESULT;
        }
 
+       /*
+        *      Set Request Lifetime
+        */
+       vp = fr_pair_find_by_num(request->control, 0, FR_REQUEST_LIFETIME, TAG_ANY);
+       if (!vp || (vp->vp_uint32 > 0)) {
+               struct timeval when;
+               const fr_event_timer_t **ev_p;
+
+               gettimeofday(&when, NULL);
+
+               if (!vp) {
+                       when.tv_sec += 30; /* default to 30s if not set */
+
+               } else if (vp->vp_uint32 > 3600) {
+                       RWARN("Request-Timeout can be no more than 3600");
+                       when.tv_sec += 3600;
+
+               } else if (vp->vp_uint32 < 5) {
+                       RWARN("Request-Timeout can be no less than 5");
+                       when.tv_sec += 5;
+
+               } else {
+                       when.tv_sec += vp->vp_uint32;
+               }
+
+               ev_p = talloc_size(request, sizeof(*ev_p));
+
+               (void) fr_event_timer_insert(request, request->el, ev_p,
+                                            &when, unlang_max_request_time, request);
+       }
+
        /*
         *      request_detach() doesn't set the "detached" flag, but
         *      it does set the backlog...