GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-08-09 09:51:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

radius: send the session ID as Acct-Session-Id in the Access-Request

Browse Source 
RFC 2866 (5.5) allows an Access-Request to carry Acct-Session-Id and
requires the same value in the session's Accounting-Requests. Sending it
already at authentication time lets the RADIUS server correlate the two
exchanges by a single per-session key (e.g. for rlm_ippool, so concurrent
sessions of the same user from the same client do not collide on one IP
lease).

Documented as REQ-AUTH-AUTH-025, with a positive check in tests/radius
that the id sent as Acct-Session-Id in the Access-Request matches the
Accounting-Request.

Signed-off-by: Dmitrii <dimmispencer@gmail.com>
Resolves: #751
This commit is contained in:
Dmitrii
2026-07-14 21:40:23 +02:00
committed by Nikos Mavrogiannopoulos
parent 6d4f96aa72
commit df086188d7
7 changed files with 73 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/radius
+34
View File
@@ -204,4 +204,38 @@ if test -z "$OCTETS" || test "$OCTETS" = 0;then
fi
echo "Transferred ${OCTETS} bytes"
# REQ-AUTH-AUTH-025: the session id must be sent as Acct-Session-Id already in
# the Access-Request, using the same value that later appears in the
# Accounting-Request so the two exchanges correlate.
echo " * Verifying Acct-Session-Id is sent during authentication..."
# Session id reported by the accounting exchange of the connected session.
ACCT_SID=$(awk '
/Received Accounting-Request/ { in_acct=1 }
/Received Access-Request/ { in_acct=0 }
in_acct && /Acct-Session-Id/ {
v=$0; sub(/.*Acct-Session-Id = /, "", v); gsub(/"/, "", v); last=v
}
END { print last }' "${RADIUSLOG}")
if test -z "${ACCT_SID}";then
cat ${RADIUSLOG}
echo "No Acct-Session-Id present in the Accounting-Request!"
exit 1
fi
# The same identifier must have been present in an Access-Request.
FOUND=$(awk -v sid="${ACCT_SID}" '
/Received Access-Request/ { in_access=1 }
/Received Accounting-Request/ { in_access=0 }
in_access && /Acct-Session-Id/ && index($0, sid) { print "yes"; exit }
' "${RADIUSLOG}")
if test "${FOUND}" != "yes";then
cat ${RADIUSLOG}
echo "Acct-Session-Id ${ACCT_SID} was not sent in any Access-Request!"
exit 1
fi
echo "Acct-Session-Id ${ACCT_SID} present in both Access-Request and Accounting-Request"
exit 0