From: Alan T. DeKok <aland@freeradius.org>
Date: Sun, 26 Nov 2017 15:42:19 +0000 (-0500)
Subject: don't proxy dynamic client definition packets
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5c1b09d138ed37f6331aca9381d0cead5ca03de1;p=thirdparty%2Ffreeradius-server.git

don't proxy dynamic client definition packets
---

diff --git a/src/modules/rlm_radius/rlm_radius.c b/src/modules/rlm_radius/rlm_radius.c
index 02d2c442ce4..2abc2d39690 100644
--- a/src/modules/rlm_radius/rlm_radius.c
+++ b/src/modules/rlm_radius/rlm_radius.c
@@ -488,22 +488,27 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(void *instance, void *thread, RE
 	 *	signaling.
 	 */
 	if (request->packet->code == FR_CODE_STATUS_SERVER) {
-		RDEBUG("Cannot proxy Status-Server packets");
+		REDEBUG("Cannot proxy Status-Server packets");
 		return RLM_MODULE_FAIL;
 	}
 
 	if ((request->packet->code >= FR_MAX_PACKET_CODE) ||
 	    !inst->retry[request->packet->code].irt) { /* can't be zero */
-		RDEBUG("Invalid packet code %d", request->packet->code);
+		REDEBUG("Invalid packet code %d", request->packet->code);
 		return RLM_MODULE_FAIL;
 	}
 
 	if (!inst->allowed[request->packet->code]) {
-		RDEBUG("Packet code %s is disallowed by the configuration",
+		REDEBUG("Packet code %s is disallowed by the configuration",
 		       fr_packet_codes[request->packet->code]);
 		return RLM_MODULE_FAIL;
 	}
 
+	if (request->client->dynamic && !request->client->active) {
+		REDEBUG("Cannot proxy packets which define dynamic clients");
+		return RLM_MODULE_FAIL;
+	}
+
 	/*
 	 *	Allocate and fill in the data structure which links
 	 *	the request to the IO submodule.