added option to send statistics periodically to sec-mod

src/config.c

@@ -109,6 +109,7 @@ static struct cfg_options available_options[] = {
 	{ .name = "net-priority", .type = OPTION_STRING, .mandatory = 0 },
 	{ .name = "output-buffer", .type = OPTION_NUMERIC, .mandatory = 0 },
 	{ .name = "cookie-timeout", .type = OPTION_NUMERIC, .mandatory = 0 },
+	{ .name = "stats-report-time", .type = OPTION_NUMERIC, .mandatory = 0 },
 	{ .name = "rekey-time", .type = OPTION_NUMERIC, .mandatory = 0 },
 	{ .name = "rekey-method", .type = OPTION_STRING, .mandatory = 0 },
 	{ .name = "auth-timeout", .type = OPTION_NUMERIC, .mandatory = 0 },
@@ -577,6 +578,8 @@ unsigned force_cert_auth;
 
 	READ_TF("deny-roaming", config->deny_roaming, 0);
 
+	READ_NUMERIC("stats-report-time", config->stats_report_time);
+
 	config->rekey_time = -1;
 	READ_NUMERIC("rekey-time", config->rekey_time);
 	if (config->rekey_time == -1) {

src/ipc.proto

@@ -86,6 +86,7 @@ message cli_stats_msg
 {
 	required uint64 bytes_in = 1;
 	required uint64 bytes_out = 2;
+	optional bytes sid = 3; /* only required by sec-mod */
 }
 
 /* UDP_FD */

src/ocserv-args.def

@@ -140,6 +140,12 @@ udp-port = 3333
 # combined with certificate authentication.
 #listen-clear-file = /var/run/ocserv-conn.socket
 
+# Stats report time. The number of seconds after which each
+# worker process will report its usage statistics (number of
+# bytes transferred etc). This is useful when accounting like
+# radius is in use.
+#stats-report-time = 360
+
 # Keepalive in seconds
 keepalive = 32400
 

src/sec-mod.c

@@ -249,6 +249,42 @@ int process_packet(void *pool, sec_mod_st * sec, cmd_request_t cmd,
 
 		return ret;
 
+	case SM_CMD_CLI_STATS:{
+			CliStatsMsg *tmsg;
+			client_entry_st *e;
+
+			tmsg = cli_stats_msg__unpack(&pa, data.size, data.data);
+			if (tmsg == NULL) {
+				seclog(sec, LOG_ERR, "error unpacking data");
+				ret = ERR_BAD_COMMAND;
+				return -1;
+			}
+
+			if (tmsg->has_sid == 0 || tmsg->sid.len != SID_SIZE) {
+				cli_stats_msg__free_unpacked(tmsg, &pa);
+				seclog(sec, LOG_INFO, "error in SID received by client (size: %d)",
+				       (int)tmsg->sid.len);
+				return -1;
+			}
+
+			e = find_client_entry(sec, tmsg->sid.data);
+			if (e == NULL) {
+				cli_stats_msg__free_unpacked(tmsg, &pa);
+				seclog(sec, LOG_INFO, "session stats received with non-existing sid!");
+				return -1;
+			}
+			cli_stats_msg__free_unpacked(tmsg, &pa);
+
+			if (e->status != PS_AUTH_COMPLETED) {
+				seclog(sec, LOG_ERR, "session stats received in unauthenticated client!");
+				return -1;
+			}
+
+			e->bytes_in = tmsg->bytes_in;
+			e->bytes_out = tmsg->bytes_out;
+		}
+		break;
+
 	case SM_CMD_AUTH_INIT:{
 			SecAuthInitMsg *auth_init;
 

src/sec-mod.h

@@ -52,6 +52,11 @@ typedef struct client_entry_st {
 	unsigned have_session; /* whether an auth session is initialized */
 	unsigned tls_auth_ok;
 
+	/* these are filled in after the worker process dies, using the
+	 * Cli stats message. */
+	uint64_t bytes_in;
+	uint64_t bytes_out;
+
 	unsigned status; /* PS_AUTH_ */
 
 	char ip[MAX_IP_STR]; /* the user's IP */

src/vpn.h

@@ -123,6 +123,7 @@ typedef enum {
 	SM_CMD_AUTH_SESSION_OPEN,
 	SM_CMD_AUTH_SESSION_CLOSE,
 	SM_CMD_AUTH_SESSION_REPLY,
+	SM_CMD_CLI_STATS,
 } cmd_request_t;
 
 #define MAX_IP_STR 46
@@ -193,6 +194,7 @@ struct cfg_st {
 	unsigned int is_dyndns;
 	char* unix_conn_file;
 	unsigned int sup_config_type; /* one of SUP_CONFIG_ */
+	unsigned int stats_report_time;
 
 	char *pin_file;
 	char *srk_pin_file;

src/worker-auth.c

@@ -641,7 +641,7 @@ static int recv_cookie_auth_reply(worker_st * ws)
 }
 
 /* returns the fd */
-static int connect_to_secmod(worker_st * ws)
+int connect_to_secmod(worker_st * ws)
 {
 	int sd, ret, e;
 
@@ -667,16 +667,6 @@ static int connect_to_secmod(worker_st * ws)
 	return sd;
 }
 
-static
-int send_msg_to_secmod(worker_st * ws, int sd, uint8_t cmd,
-		       const void *msg, pack_size_func get_size, pack_func pack)
-{
-	oclog(ws, LOG_DEBUG, "sending message '%s' to secmod",
-	      cmd_request_to_str(cmd));
-
-	return send_msg(ws, sd, cmd, msg, get_size, pack);
-}
-
 static int recv_auth_reply(worker_st * ws, int sd, char *txt,
 			   size_t max_txt_size)
 {

src/worker-vpn.c

@@ -992,6 +992,34 @@ int periodic_check(worker_st * ws, unsigned mtu_overhead, time_t now,
 
 	}
 
+	if (ws->config->stats_report_time > 0 &&
+	    now - ws->last_stats_msg >= ws->config->stats_report_time &&
+	    ws->sid_set) {
+		CliStatsMsg msg = CLI_STATS_MSG__INIT;
+		int sd;
+
+		ws->last_stats_msg = now;
+
+		sd = connect_to_secmod(ws);
+		if (sd >= 0) {
+			msg.bytes_in = ws->tun_bytes_in;
+			msg.bytes_out = ws->tun_bytes_out;
+			msg.sid.len = sizeof(ws->sid);
+			msg.sid.data = ws->sid;
+			msg.has_sid = 1;
+
+			send_msg_to_secmod(ws, sd, SM_CMD_CLI_STATS, &msg,
+					 (pack_size_func)cli_stats_msg__get_packed_size,
+					 (pack_func) cli_stats_msg__pack);
+			close(sd);
+
+			oclog(ws, LOG_DEBUG,
+			      "sending periodic stats (in: %lu, out: %lu) to sec-mod",
+			      (unsigned long)msg.bytes_in,
+			      (unsigned long)msg.bytes_out);
+		}
+	}
+
 	/* check DPD. Otherwise exit */
 	if (ws->udp_state == UP_ACTIVE &&
 	    now - ws->last_msg_udp > DPD_TRIES * dpd && dpd > 0) {

src/worker.h

@@ -172,6 +172,9 @@ typedef struct worker_st {
 	time_t last_tls_rehandshake;
 	time_t last_dtls_rehandshake;
 
+	/* the time the last stats message was sent */
+	time_t last_stats_msg;
+
 	/* for mtu trials */
 	unsigned last_good_mtu;
 	unsigned last_bad_mtu;
@@ -274,6 +277,17 @@ int handle_worker_commands(struct worker_st *ws);
 int disable_system_calls(struct worker_st *ws);
 void ocsigaltstack(struct worker_st *ws);
 
+int connect_to_secmod(worker_st * ws);
+inline static
+int send_msg_to_secmod(worker_st * ws, int sd, uint8_t cmd,
+		       const void *msg, pack_size_func get_size, pack_func pack)
+{
+	oclog(ws, LOG_DEBUG, "sending message '%s' to secmod",
+	      cmd_request_to_str(cmd));
+
+	return send_msg(ws, sd, cmd, msg, get_size, pack);
+}
+
 inline static
 int send_msg_to_main(worker_st *ws, uint8_t cmd, 
 	    const void* msg, pack_size_func get_size, pack_func pack)