A few more assertions about fake packets.

	In the three cases where packets are *originally* sent from the
	server (not re-sends), do NOT send the packet if it's a fake
	request.

	This will make managing tunneled sessions easier.

diff --git a/src/main/proxy.c b/src/main/proxy.c
index 690e24f..25fccb2 100644 (file)
--- a/src/main/proxy.c
+++ b/src/main/proxy.c
@@ -420,9 +420,9 @@ int proxy_send(REQUEST *request)
 
        /*
         *      Add the request to the list of outstanding requests.
-        *      Note that request->proxy->id is a 16 bits value,
-        *      while rad_send sends only the 8 least significant
-        *      bits of that same value.
+        *      Note that request->proxy->id is a 16 bits value, while
+        *      the RADIUS id has only the 8 least significant bits of
+        *      that same value.
         */
        request->proxy->id = (proxy_id++) & 0xff;
        proxy_id &= 0xffff;
@@ -466,7 +466,16 @@ int proxy_send(REQUEST *request)
            (rcode == RLM_MODULE_NOOP) ||
            (rcode == RLM_MODULE_UPDATED)) {
                request->options |= RAD_REQUEST_OPTION_PROXIED;
-               rad_send(request->proxy, NULL, (char *)request->proxysecret);
+
+               /*
+                *      IF it's a fake request, don't send the proxy
+                *      packet.  The outer tunnel session will take
+                *      care of doing that.
+                */
+               if ((request->options & RAD_REQUEST_OPTION_FAKE_REQUEST) == 0) {
+                       rad_send(request->proxy, NULL,
+                                (char *)request->proxysecret);
+               }
                rcode = RLM_MODULE_HANDLED; /* caller doesn't reply */
        } else {
                rcode = RLM_MODULE_FAIL; /* caller doesn't reply */

diff --git a/src/main/radiusd.c b/src/main/radiusd.c
index b389729..994a525 100644 (file)
--- a/src/main/radiusd.c
+++ b/src/main/radiusd.c
@@ -248,7 +248,7 @@ static RAD_REQUEST_FUNP packet_ok(RADIUS_PACKET *packet,
                                  rad_listen_t *listener)
 {
        REQUEST         *curreq;
-       RAD_REQUEST_FUNP fun;
+       RAD_REQUEST_FUNP fun = NULL;
 
        /*
         *      Some sanity checks, based on the packet code.
@@ -407,6 +407,15 @@ static RAD_REQUEST_FUNP packet_ok(RADIUS_PACKET *packet,
        }
 
        /*
+        *      "fake" requests MUST NEVER be in the request list.
+        *
+        *      They're used internally in the server.  Any reply
+        *      is a reply to the local server, and any proxied packet
+        *      gets sent outside of the tunnel.
+        */
+       rad_assert((curreq->options & RAD_REQUEST_OPTION_FAKE_REQUEST) == 0);
+
+       /*
         *      The current request isn't finished, which
         *      means that the NAS sent us a new packet, while
         *      we are still processing the old request.
@@ -1803,8 +1812,17 @@ int rad_respond(REQUEST *request, RAD_REQUEST_FUNP fun)
                 */
                if ((request->reply->code != PW_AUTHENTICATION_REJECT) ||
                    (mainconfig.reject_delay == 0)) {
-                       rad_send(request->reply, request->packet,
-                                request->secret);
+                       /*
+                        *      Send the response. IF it's a real request.
+                        */
+                       if ((request->options & RAD_REQUEST_OPTION_FAKE_REQUEST) == 0) {
+                               rad_send(request->reply, request->packet,
+                                        request->secret);
+                       }
+                       /*
+                        *      Otherwise, it's a tunneled request.
+                        *      Don't do anything.
+                        */
                } else {
                        DEBUG2("Delaying request %d for %d seconds",
                               request->number, mainconfig.reject_delay);
@@ -1998,6 +2016,8 @@ static void sig_hup(int sig)
        sig = sig; /* -Wunused */
        reset_signal(SIGHUP, sig_hup);
 
+       exit(0);
+
        /*
         *  Only do the reload if we're the main server, both
         *  for processes, and for threads.

diff --git a/src/main/threads.c b/src/main/threads.c
index efb1486..3c8628b 100644 (file)
--- a/src/main/threads.c
+++ b/src/main/threads.c
@@ -312,8 +312,8 @@ static void request_dequeue(REQUEST **request, RAD_REQUEST_FUNP *fun)
 
        /*
         *      If the request is currently being processed, then that
-        *      MAY be OK, if it's a proxy reply.  In that case, the
-        *      rad_send() of the packet may result in a reply being
+        *      MAY be OK, if it's a proxy reply.  In that case,
+        *      sending the packet may result in a reply being
         *      received before that thread clears the child_pid.
         *
         *      In that case, we busy-wait for the request to be free.

diff --git a/src/main/util.c b/src/main/util.c
index 0ef2cb1..4d5cb3f 100644 (file)
--- a/src/main/util.c
+++ b/src/main/util.c
@@ -519,9 +519,12 @@ void rfc_clean(RADIUS_PACKET *packet)
        }
 
        /*
-        *  If a reply exists, send it.
+        *      If a reply exists, send it.
+        *
+        *      But DON'T send a RADIUS packet for a fake request.
         */
-       if (request->reply->code != 0) {
+       if ((request->reply->code != 0) &&
+           ((request->options & RAD_REQUEST_OPTION_FAKE_REQUEST) == 0)) {
                /*
                 *      If we're not delaying authentication rejects,
                 *      then send the response immediately.  Otherwise,
@@ -530,7 +533,7 @@ void rfc_clean(RADIUS_PACKET *packet)
                 */
                if (mainconfig.reject_delay == 0) {
                        rad_send(request->reply, request->packet,
-                                request->secret);
+                                    request->secret);
                } else {
                        request->options |= RAD_REQUEST_OPTION_DELAYED_REJECT;
                }