From: Alan T. DeKok Date: Fri, 31 Oct 2014 15:05:27 +0000 (-0400) Subject: Tie session state into the rest of the server. X-Git-Tag: branch_3_1_x~4806 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=dcb89481e4a94754f0e4d9e05cab6bd8f6f3d449;p=thirdparty%2Ffreeradius-server.git Tie session state into the rest of the server. --- diff --git a/man/man5/unlang.5 b/man/man5/unlang.5 index b9d483c373d..7d274c47f7e 100644 --- a/man/man5/unlang.5 +++ b/man/man5/unlang.5 @@ -191,8 +191,9 @@ the current block. .DE The can be one of "request", "reply", "proxy-request", -"proxy-reply", "coa", "disconnect", or "control". As of Version 3, -the can be omitted, in which case "request" is assumed. +"proxy-reply", "coa", "disconnect", "session-state", or "control". As +of Version 3, the can be omitted, in which case "request" is +assumed. The "control" list is the list of attributes maintainted internally by the server that controls how the server processes the request. Any @@ -215,6 +216,11 @@ packet. That packet is sent when the current Access-Request or Accounting-Request has been finished, and a reply sent to the NAS. See raddb/sites-available/originate-coa for additional information. +The "session-state" list is primarily used for EAP. Attributes put +into the "session-state" list are saved for the next packet in the +session. They are automatically retreived when the next packet is +received. + The only contents permitted in an "update" section are attributes and values. The contents of the "update" section are described in the ATTRIBUTE REFERENCE and ATTRIBUTE ASSIGNMENT sections below. diff --git a/src/include/radiusd.h b/src/include/radiusd.h index 7513b37e0a0..1e6d9b05df8 100644 --- a/src/include/radiusd.h +++ b/src/include/radiusd.h @@ -222,6 +222,8 @@ struct rad_request { #endif VALUE_PAIR *config_items; //!< VALUE_PAIRs used to set per request parameters //!< for modules and the server core at runtime. + VALUE_PAIR *state; //!< VALUE_PAIRs used to set session parameters + //!< for multiple packets, e.g. EAP. VALUE_PAIR *username; //!< Cached username VALUE_PAIR. VALUE_PAIR *password; //!< Cached password VALUE_PAIR. diff --git a/src/include/tmpl.h b/src/include/tmpl.h index d7606f9c889..9b04505b204 100644 --- a/src/include/tmpl.h +++ b/src/include/tmpl.h @@ -25,6 +25,7 @@ typedef enum pair_lists { PAIR_LIST_REQUEST, PAIR_LIST_REPLY, PAIR_LIST_CONTROL, + PAIR_LIST_STATE, #ifdef WITH_PROXY PAIR_LIST_PROXY_REQUEST, PAIR_LIST_PROXY_REPLY, diff --git a/src/main/auth.c b/src/main/auth.c index e2f76828d83..4b7a8f09cb1 100644 --- a/src/main/auth.c +++ b/src/main/auth.c @@ -25,6 +25,7 @@ RCSID("$Id$") #include #include +#include #include #include @@ -313,6 +314,7 @@ int rad_postauth(REQUEST *request) case RLM_MODULE_USERLOCK: default: request->reply->code = PW_CODE_ACCESS_REJECT; + fr_state_discard(request, request->packet); result = RLM_MODULE_REJECT; break; /* @@ -329,6 +331,12 @@ int rad_postauth(REQUEST *request) case RLM_MODULE_OK: case RLM_MODULE_UPDATED: result = RLM_MODULE_OK; + + if (request->reply->code == PW_CODE_ACCESS_CHALLENGE) { + fr_state_put_vps(request, request->packet, request->reply); + } else if (request->reply->code == PW_CODE_ACCESS_ACCEPT) { + fr_state_discard(request, request->packet); + } break; } return result; @@ -415,6 +423,11 @@ int rad_authenticate(REQUEST *request) request->password = pairfind(request->packet->vps, PW_CHAP_PASSWORD, 0, TAG_ANY); } + /* + * Grab the VPS associated with the State attribute. + */ + fr_state_get_vps(request, request->packet); + /* * Get the user's authorization information from the database */ diff --git a/src/main/radiusd.c b/src/main/radiusd.c index cb0d77b2c6e..bc285bd7a1f 100644 --- a/src/main/radiusd.c +++ b/src/main/radiusd.c @@ -29,6 +29,7 @@ RCSID("$Id$") #include #include +#include #include #include @@ -578,6 +579,8 @@ int main(int argc, char *argv[]) */ fr_strerror(); + fr_state_init(); + /* * Process requests until HUP or exit. */ @@ -637,6 +640,8 @@ cleanup: xlat_free(); /* modules may have xlat's */ + fr_state_delete(); + /* * Free the configuration items. */ diff --git a/src/main/radiusd.mk b/src/main/radiusd.mk index 9a33539f90b..eb6ea991c39 100644 --- a/src/main/radiusd.mk +++ b/src/main/radiusd.mk @@ -1,7 +1,7 @@ TARGET := radiusd SOURCES := acct.c auth.c client.c crypt.c files.c \ listen.c mainconfig.c modules.c modcall.c \ - radiusd.c stats.c soh.c connection.c \ + radiusd.c state.c stats.c soh.c connection.c \ session.c threads.c version.c \ process.c realms.c detail.c ifneq ($(OPENSSL_LIBS),) diff --git a/src/main/tmpl.c b/src/main/tmpl.c index 7fcbc995b7b..3f47798308b 100644 --- a/src/main/tmpl.c +++ b/src/main/tmpl.c @@ -36,6 +36,7 @@ const FR_NAME_NUMBER pair_lists[] = { { "reply", PAIR_LIST_REPLY }, { "control", PAIR_LIST_CONTROL }, /* New name should have priority */ { "config", PAIR_LIST_CONTROL }, + { "session-state", PAIR_LIST_STATE }, #ifdef WITH_PROXY { "proxy-request", PAIR_LIST_PROXY_REQUEST }, { "proxy-reply", PAIR_LIST_PROXY_REPLY }, @@ -188,6 +189,9 @@ VALUE_PAIR **radius_list(REQUEST *request, pair_lists_t list) case PAIR_LIST_CONTROL: return &request->config_items; + case PAIR_LIST_STATE: + return &request->state; + #ifdef WITH_PROXY case PAIR_LIST_PROXY_REQUEST: if (!request->proxy) break; @@ -258,6 +262,9 @@ TALLOC_CTX *radius_list_ctx(REQUEST *request, pair_lists_t list_name) case PAIR_LIST_CONTROL: return request; + case PAIR_LIST_STATE: + return request; + #ifdef WITH_PROXY case PAIR_LIST_PROXY_REQUEST: return request->proxy; diff --git a/src/main/unittest.c b/src/main/unittest.c index 485891ad6ea..42219b166e3 100644 --- a/src/main/unittest.c +++ b/src/main/unittest.c @@ -25,6 +25,7 @@ RCSID("$Id$") #include #include +#include #include #ifdef HAVE_GETOPT_H @@ -540,6 +541,8 @@ int main(int argc, char *argv[]) goto finish; } + fr_state_init(); + /* Set the panic action (if required) */ if (main_config.panic_action && #ifndef NDEBUG @@ -665,6 +668,8 @@ finish: xlat_free(); /* modules may have xlat's */ + fr_state_delete(); + /* * Free the configuration items. */ diff --git a/src/main/unittest.mk b/src/main/unittest.mk index a939b963cca..804efeef8b7 100644 --- a/src/main/unittest.mk +++ b/src/main/unittest.mk @@ -1,7 +1,7 @@ TARGET := unittest SOURCES := acct.c auth.c client.c crypt.c files.c \ mainconfig.c modules.c modcall.c \ - unittest.c soh.c connection.c \ + unittest.c soh.c state.c connection.c \ session.c threads.c version.c \ realms.c