denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

eap-radius: Fix access to IKE_SA when sending interim updates

Browse Source 
The previous code checked in the IKE_SA before using it again to
add attributes based on it to the interim update message.  This
change ensures the IKE_SA is only accessed while it is checked out.
The Acct-Status-Type attribute is still sent first, but the
Acct-Session-Id and Class attributes are now sent after the IKE
parameters, which shouldn't really matter, though.

Fixes: d019764ab6 ("Add support for RADIUS Interim accounting updates")
This commit is contained in:
Tobias Brunner
2026-07-24 08:47:37 +02:00
parent 588c7a80d1
commit 2ed81ed53a
1 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/eap_radius/eap_radius_accounting.c
+9 -4
View File
@@ -581,6 +581,10 @@ static job_requeue_t send_interim(interim_data_t *data)
return JOB_REQUEUE_NONE; return JOB_REQUEUE_NONE;
} }
stats = collect_stats(ike_sa, &usage); stats = collect_stats(ike_sa, &usage);
message = radius_message_create(RMC_ACCOUNTING_REQUEST);
value = htonl(ACCT_STATUS_INTERIM_UPDATE);
message->add(message, RAT_ACCT_STATUS_TYPE, chunk_from_thing(value));
add_ike_sa_parameters(this, message, ike_sa);
charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa); charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
/* avoid any races by returning IKE_SA before acquiring lock */ /* avoid any races by returning IKE_SA before acquiring lock */
@@ -631,13 +635,9 @@ static job_requeue_t send_interim(interim_data_t *data)
add_usage(&usage, entry->usage); add_usage(&usage, entry->usage);
message = radius_message_create(RMC_ACCOUNTING_REQUEST);
value = htonl(ACCT_STATUS_INTERIM_UPDATE);
message->add(message, RAT_ACCT_STATUS_TYPE, chunk_from_thing(value));
message->add(message, RAT_ACCT_SESSION_ID, message->add(message, RAT_ACCT_SESSION_ID,
chunk_create(entry->sid, strlen(entry->sid))); chunk_create(entry->sid, strlen(entry->sid)));
add_class_attributes(message, entry); add_class_attributes(message, entry);
add_ike_sa_parameters(this, message, ike_sa);
value = htonl(usage.bytes.sent); value = htonl(usage.bytes.sent);
message->add(message, RAT_ACCT_OUTPUT_OCTETS, chunk_from_thing(value)); message->add(message, RAT_ACCT_OUTPUT_OCTETS, chunk_from_thing(value));
@@ -666,6 +666,11 @@ static job_requeue_t send_interim(interim_data_t *data)
schedule_interim(this, entry); schedule_interim(this, entry);
} }
else
{
message->destroy(message);
message = NULL;
}
this->mutex->unlock(this->mutex); this->mutex->unlock(this->mutex);
array_destroy_function(stats, (void*)free, NULL); array_destroy_function(stats, (void*)free, NULL);