Merge branch 'radius-accounting-unclaimed'

Adds all IPs to RADIUS Accounting-Stop messages even those not claimed by
a client.  For instance, if the connection fails with FAILED_CP_REQUIRED,
adding the unclaimed addresses allows the RADIUS server to release the
leases early.

Fixes #2856.

src/libcharon/plugins/eap_radius/eap_radius_accounting.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015-2017 Tobias Brunner
+ * Copyright (C) 2015-2018 Tobias Brunner
  * HSR Hochschule fuer Technik Rapperswil
  *
  * Copyright (C) 2012 Martin Willi
@@ -17,6 +17,7 @@
  */
 
 #include "eap_radius_accounting.h"
+#include "eap_radius_provider.h"
 #include "eap_radius_plugin.h"
 
 #include <time.h>
@@ -460,6 +461,37 @@ static void add_ike_sa_parameters(private_eap_radius_accounting_t *this,
 	enumerator->destroy(enumerator);
 }
 
+/**
+ * Add any unclaimed IP addresses to the message
+ */
+static void add_unclaimed_ips(radius_message_t *message, ike_sa_t *ike_sa)
+{
+	eap_radius_provider_t *provider;
+	enumerator_t *enumerator;
+	host_t *vip;
+
+	provider = eap_radius_provider_get();
+	enumerator = provider->clear_unclaimed(provider,
+										   ike_sa->get_unique_id(ike_sa));
+	while (enumerator->enumerate(enumerator, &vip))
+	{
+		switch (vip->get_family(vip))
+		{
+			case AF_INET:
+				message->add(message, RAT_FRAMED_IP_ADDRESS,
+							 vip->get_address(vip));
+				break;
+			case AF_INET6:
+				message->add(message, RAT_FRAMED_IPV6_ADDRESS,
+							 vip->get_address(vip));
+				break;
+			default:
+				break;
+		}
+	}
+	enumerator->destroy(enumerator);
+}
+
 /**
  * Add the Class attributes received in the Access-Accept message to the
  * RADIUS accounting message
@@ -790,6 +822,7 @@ static void send_stop(private_eap_radius_accounting_t *this, ike_sa_t *ike_sa)
 					 chunk_create(entry->sid, strlen(entry->sid)));
 		add_class_attributes(message, entry);
 		add_ike_sa_parameters(this, message, ike_sa);
+		add_unclaimed_ips(message, ike_sa);
 
 		value = htonl(entry->usage.bytes.sent);
 		message->add(message, RAT_ACCT_OUTPUT_OCTETS, chunk_from_thing(value));
@@ -816,7 +849,6 @@ static void send_stop(private_eap_radius_accounting_t *this, ike_sa_t *ike_sa)
 		value = htonl(time_monotonic(NULL) - entry->created);
 		message->add(message, RAT_ACCT_SESSION_TIME, chunk_from_thing(value));
 
-
 		value = htonl(entry->cause);
 		message->add(message, RAT_ACCT_TERMINATE_CAUSE, chunk_from_thing(value));
 

src/libcharon/plugins/eap_radius/eap_radius_provider.c

@@ -1,4 +1,7 @@
 /*
+ * Copyright (C) 2018 Tobias Brunner
+ * HSR Hochschule fuer Technik Rapperswil
+ *
  * Copyright (C) 2013 Martin Willi
  * Copyright (C) 2013 revosec AG
  *
@@ -131,7 +134,7 @@ static entry_t* get_or_create_entry(hashtable_t *hashtable, uintptr_t id)
 }
 
 /**
- * Put an entry to hashtable, or destroy it ife empty
+ * Put an entry to hashtable, or destroy it if empty
  */
 static void put_or_destroy_entry(hashtable_t *hashtable, entry_t *entry)
 {
@@ -494,6 +497,24 @@ METHOD(eap_radius_provider_t, add_attribute, void,
 	this->listener.mutex->unlock(this->listener.mutex);
 }
 
+METHOD(eap_radius_provider_t, clear_unclaimed, enumerator_t*,
+	private_eap_radius_provider_t *this, uint32_t id)
+{
+	entry_t *entry;
+
+	this->listener.mutex->lock(this->listener.mutex);
+	entry = this->listener.unclaimed->remove(this->listener.unclaimed,
+											 (void*)(uintptr_t)id);
+	this->listener.mutex->unlock(this->listener.mutex);
+	if (!entry)
+	{
+		return enumerator_create_empty();
+	}
+	return enumerator_create_cleaner(
+					entry->addrs->create_enumerator(entry->addrs),
+					(void*)destroy_entry, entry);
+}
+
 METHOD(eap_radius_provider_t, destroy, void,
 	private_eap_radius_provider_t *this)
 {
@@ -523,6 +544,7 @@ eap_radius_provider_t *eap_radius_provider_create()
 				},
 				.add_framed_ip = _add_framed_ip,
 				.add_attribute = _add_attribute,
+				.clear_unclaimed = _clear_unclaimed,
 				.destroy = _destroy,
 			},
 			.listener = {
@@ -539,6 +561,14 @@ eap_radius_provider_t *eap_radius_provider_create()
 			},
 		);
 
+		if (lib->settings->get_bool(lib->settings,
+							"%s.plugins.eap-radius.accounting", FALSE, lib->ns))
+		{
+			/* if RADIUS accounting is enabled, keep unclaimed IPs around until
+			 * the Accounting-Stop message is sent */
+			this->listener.public.message = NULL;
+		}
+
 		charon->bus->add_listener(charon->bus, &this->listener.public);
 
 		singleton = &this->public;

src/libcharon/plugins/eap_radius/eap_radius_provider.h

@@ -1,4 +1,7 @@
 /*
+ * Copyright (C) 2018 Tobias Brunner
+ * HSR Hochschule fuer Technik Rapperswil
+ *
  * Copyright (C) 2013 Martin Willi
  * Copyright (C) 2013 revosec AG
  *
@@ -55,6 +58,14 @@ struct eap_radius_provider_t {
 	void (*add_attribute)(eap_radius_provider_t *this, uint32_t id,
 						  configuration_attribute_type_t type, chunk_t data);
 
+	/**
+	 * Clears any unclaimed IP addresses and attributes for the given IKE_SA.
+	 *
+	 * @param id			IKE_SA unique identifier
+	 * @return				enumerator over unclaimed IP addresses, if any
+	 */
+	enumerator_t *(*clear_unclaimed)(eap_radius_provider_t *this, uint32_t id);
+
 	/**
 	 * Destroy a eap_radius_provider_t.
 	 */