3 char const *cvs_id_radius
= "$Id: radius.c,v 1.38 2005/07/31 10:35:39 bodea Exp $";
8 #include <sys/socket.h>
12 #include <arpa/inet.h>
14 #include <netinet/in.h>
16 #include <openssl/md5.h>
17 #include "constants.h"
23 extern radiust
*radius
;
24 extern sessiont
*session
;
25 extern tunnelt
*tunnel
;
26 extern configt
*config
;
28 extern ip_filtert
*ip_filters
;
30 // Set up socket for radius requests
34 LOG(3, 0, 0, "Creating %d sockets for RADIUS queries\n", RADIUS_FDS
);
35 radfds
= calloc(sizeof(int), RADIUS_FDS
);
36 for (i
= 0; i
< RADIUS_FDS
; i
++)
39 radfds
[i
] = socket(AF_INET
, SOCK_DGRAM
, IPPROTO_UDP
);
40 flags
= fcntl(radfds
[i
], F_GETFL
, 0);
41 fcntl(radfds
[i
], F_SETFL
, flags
| O_NONBLOCK
);
45 void radiusclear(uint16_t r
, sessionidt s
)
47 if (s
) sess_local
[s
].radius
= 0;
48 memset(&radius
[r
], 0, sizeof(radius
[r
])); // radius[r].state = RADIUSNULL;
51 static uint16_t get_free_radius()
54 static uint32_t next_radius_id
= 0;
56 for (count
= MAXRADIUS
; count
> 0; --count
)
58 ++next_radius_id
; // Find the next ID to check.
59 if (next_radius_id
>= MAXRADIUS
)
62 if (radius
[next_radius_id
].state
== RADIUSNULL
)
64 return next_radius_id
;
68 LOG(0, 0, 0, "Can't find a free radius session! This is very bad!\n");
72 uint16_t radiusnew(sessionidt s
)
74 uint16_t r
= sess_local
[s
].radius
;
79 LOG(3, s
, session
[s
].tunnel
, "Re-used radius %d\n", r
);
83 if (!(r
= get_free_radius()))
85 LOG(1, s
, session
[s
].tunnel
, "No free RADIUS sessions\n");
86 STAT(radius_overflow
);
90 memset(&radius
[r
], 0, sizeof(radius
[r
]));
91 sess_local
[s
].radius
= r
;
92 radius
[r
].session
= s
;
93 radius
[r
].state
= RADIUSWAIT
;
94 radius
[r
].retry
= TIME
+ 1200; // Wait at least 120 seconds to re-claim this.
96 random_data(radius
[r
].auth
, sizeof(radius
[r
].auth
));
98 LOG(3, s
, session
[s
].tunnel
, "Allocated radius %d\n", r
);
102 // Send a RADIUS request
103 void radiussend(uint16_t r
, uint8_t state
)
105 struct sockaddr_in addr
;
106 uint8_t b
[4096]; // RADIUS packet
114 s
= radius
[r
].session
;
115 if (!config
->numradiusservers
)
117 LOG(0, s
, session
[s
].tunnel
, "No RADIUS servers\n");
120 if (!*config
->radiussecret
)
122 LOG(0, s
, session
[s
].tunnel
, "No RADIUS secret\n");
126 if (state
!= RADIUSAUTH
&& !config
->radius_accounting
)
128 // Radius accounting is turned off
133 if (radius
[r
].state
!= state
)
136 radius
[r
].state
= state
;
137 radius
[r
].retry
= backoff(radius
[r
].try++) + 20; // 3s, 4s, 6s, 10s...
138 LOG(4, s
, session
[s
].tunnel
, "Send RADIUS id %d sock %d state %s try %d\n",
139 r
>> RADIUS_SHIFT
, r
& RADIUS_MASK
,
140 radius_state(radius
[r
].state
), radius
[r
].try);
142 if (radius
[r
].try > config
->numradiusservers
* 2)
146 if (state
== RADIUSAUTH
)
147 sessionshutdown(s
, "RADIUS timeout.", 3, 0);
150 LOG(1, s
, session
[s
].tunnel
, "RADIUS timeout, but in state %s so don't timeout session\n",
151 radius_state(state
));
154 STAT(radius_timeout
);
158 STAT(radius_retries
);
159 radius
[r
].state
= RADIUSWAIT
;
160 radius
[r
].retry
= 100;
164 // contruct RADIUS access request
168 b
[0] = AccessRequest
; // access request
173 b
[0] = AccountingRequest
; // accounting request
176 LOG(0, 0, 0, "Unknown radius state %d\n", state
);
178 b
[1] = r
>> RADIUS_SHIFT
; // identifier
179 memcpy(b
+ 4, radius
[r
].auth
, 16);
184 p
[1] = strlen(session
[s
].user
) + 2;
185 strcpy((char *) p
+ 2, session
[s
].user
);
188 if (state
== RADIUSAUTH
)
192 *p
= 3; // CHAP password
194 p
[2] = radius
[r
].id
; // ID
195 memcpy(p
+ 3, radius
[r
].pass
, 16); // response from CHAP request
197 *p
= 60; // CHAP Challenge
199 memcpy(p
+ 2, radius
[r
].auth
, 16);
204 strcpy(pass
, radius
[r
].pass
);
207 pass
[pl
++] = 0; // pad
216 MD5_Update(&ctx
, config
->radiussecret
, strlen(config
->radiussecret
));
218 MD5_Update(&ctx
, pass
+ p
- 16, 16);
220 MD5_Update(&ctx
, radius
[r
].auth
, 16);
221 MD5_Final(hash
, &ctx
);
224 pass
[p
] ^= hash
[p
& 15];
233 memcpy(p
+ 2, pass
, pl
);
237 else if (state
== RADIUSSTART
|| state
== RADIUSSTOP
|| state
== RADIUSINTERIM
)
239 *p
= 40; // accounting type
241 *(uint32_t *) (p
+ 2) = htonl(state
- RADIUSSTART
+ 1); // start=1, stop=2, interim=3
245 *p
= 44; // session ID
247 sprintf((char *) p
+ 2, "%08X%08X", session
[s
].unique_id
, session
[s
].opened
);
249 if (state
== RADIUSSTART
)
253 *(uint32_t *) (p
+ 2) = htonl(time(NULL
) - session
[s
].opened
);
255 sess_local
[s
].last_interim
= time_now
; // Setup "first" Interim
259 *p
= 42; // input octets
261 *(uint32_t *) (p
+ 2) = htonl(session
[s
].cin
);
264 *p
= 43; // output octets
266 *(uint32_t *) (p
+ 2) = htonl(session
[s
].cout
);
269 *p
= 46; // session time
271 *(uint32_t *) (p
+ 2) = htonl(time(NULL
) - session
[s
].opened
);
274 *p
= 47; // input packets
276 *(uint32_t *) (p
+ 2) = htonl(session
[s
].pin
);
279 *p
= 48; // output packets
281 *(uint32_t *) (p
+ 2) = htonl(session
[s
].pout
);
284 *p
= 52; // input gigawords
286 *(uint32_t *) (p
+ 2) = htonl(session
[s
].cin_wrap
);
289 *p
= 53; // output gigawords
291 *(uint32_t *) (p
+ 2) = htonl(session
[s
].cout_wrap
);
295 if (session
[s
].snoop_ip
&& session
[s
].snoop_port
)
297 *p
= 26; // vendor-specific
298 *(uint32_t *) (p
+ 2) = htonl(9); // Cisco
299 p
[6] = 1; // Cisco-AVPair
300 p
[7] = 2 + sprintf((char *) p
+ 8, "intercept=%s:%d",
301 fmtaddr(session
[s
].snoop_ip
, 0), session
[s
].snoop_port
);
312 *(uint32_t *) (p
+ 2) = htonl(s
);
315 if (s
&& session
[s
].ip
)
317 *p
= 8; // Framed-IP-Address
319 *(uint32_t *) (p
+ 2) = htonl(session
[s
].ip
);
322 if (*session
[s
].called
)
325 p
[1] = strlen(session
[s
].called
) + 2;
326 strcpy((char *) p
+ 2, session
[s
].called
);
329 else if (*session
[s
].calling
)
332 p
[1] = strlen(session
[s
].calling
) + 2;
333 strcpy((char *) p
+ 2, session
[s
].calling
);
339 *(uint32_t *)(p
+ 2) = config
->bind_address
;
343 *(uint16_t *) (b
+ 2) = htons(p
- b
);
344 if (state
!= RADIUSAUTH
)
346 // Build auth for accounting packet
348 uint8_t hash
[16] = {0};
351 MD5_Update(&ctx
, b
, 4);
352 MD5_Update(&ctx
, z
, 16);
353 MD5_Update(&ctx
, b
+ 20, (p
- b
) - 20);
354 MD5_Update(&ctx
, config
->radiussecret
, strlen(config
->radiussecret
));
355 MD5_Final(hash
, &ctx
);
356 memcpy(b
+ 4, hash
, 16);
357 memcpy(radius
[r
].auth
, hash
, 16);
359 memset(&addr
, 0, sizeof(addr
));
360 addr
.sin_family
= AF_INET
;
361 *(uint32_t *) & addr
.sin_addr
= config
->radiusserver
[(radius
[r
].try - 1) % config
->numradiusservers
];
364 uint16_t port
= config
->radiusport
[(radius
[r
].try - 1) % config
->numradiusservers
];
365 // assume RADIUS accounting port is the authentication port +1
366 addr
.sin_port
= htons((state
== RADIUSAUTH
) ? port
: port
+1);
369 LOG_HEX(5, "RADIUS Send", b
, (p
- b
));
370 sendto(radfds
[r
& RADIUS_MASK
], b
, p
- b
, 0, (void *) &addr
, sizeof(addr
));
373 static void handle_avpair(sessionidt s
, uint8_t *avp
, int len
)
376 uint8_t *value
= memchr(avp
, '=', len
);
377 uint8_t tmp
[2048] = "";
391 if (len
> 2 && (*value
== '"' || *value
== '\'') && value
[len
- 1] == *value
)
397 // copy and null terminate
398 else if (len
< sizeof(tmp
) - 1)
400 memcpy(tmp
, value
, len
);
409 struct param_radius_response p
= { &tunnel
[session
[s
].tunnel
], &session
[s
], (char *) key
, (char *) value
};
410 run_plugins(PLUGIN_RADIUS_RESPONSE
, &p
);
414 // process RADIUS response
415 void processrad(uint8_t *buf
, int len
, char socket_index
)
417 uint8_t b
[MAXCONTROL
];
429 LOG_HEX(5, "RADIUS Response", buf
, len
);
430 if (len
< 20 || len
< ntohs(*(uint16_t *) (buf
+ 2)))
432 LOG(1, 0, 0, "Duff RADIUS response length %d\n", len
);
436 r_code
= buf
[0]; // response type
437 r_id
= buf
[1]; // radius reply indentifier.
439 len
= ntohs(*(uint16_t *) (buf
+ 2));
440 r
= socket_index
| (r_id
<< RADIUS_SHIFT
);
441 s
= radius
[r
].session
;
442 LOG(3, s
, session
[s
].tunnel
, "Received %s, radius %d response for session %u (%s, id %d)\n",
443 radius_state(radius
[r
].state
), r
, s
, radius_code(r_code
), r_id
);
445 if (!s
&& radius
[r
].state
!= RADIUSSTOP
)
447 LOG(1, s
, session
[s
].tunnel
, " Unexpected RADIUS response\n");
450 if (radius
[r
].state
!= RADIUSAUTH
&& radius
[r
].state
!= RADIUSSTART
451 && radius
[r
].state
!= RADIUSSTOP
&& radius
[r
].state
!= RADIUSINTERIM
)
453 LOG(1, s
, session
[s
].tunnel
, " Unexpected RADIUS response\n");
456 t
= session
[s
].tunnel
;
458 MD5_Update(&ctx
, buf
, 4);
459 MD5_Update(&ctx
, radius
[r
].auth
, 16);
460 MD5_Update(&ctx
, buf
+ 20, len
- 20);
461 MD5_Update(&ctx
, config
->radiussecret
, strlen(config
->radiussecret
));
462 MD5_Final(hash
, &ctx
);
464 if (memcmp(hash
, buf
+ 4, 16))
466 LOG(0, s
, session
[s
].tunnel
, " Incorrect auth on RADIUS response!! (wrong secret in radius config?)\n");
467 return; // Do nothing. On timeout, it will try the next radius server.
470 if ((radius
[r
].state
== RADIUSAUTH
&& r_code
!= AccessAccept
&& r_code
!= AccessReject
) ||
471 ((radius
[r
].state
== RADIUSSTART
|| radius
[r
].state
== RADIUSSTOP
|| radius
[r
].state
== RADIUSINTERIM
) && r_code
!= AccountingResponse
))
473 LOG(1, s
, session
[s
].tunnel
, " Unexpected RADIUS response %s\n", radius_code(r_code
));
474 return; // We got something we didn't expect. Let the timeouts take
475 // care off finishing the radius session if that's really correct.
478 if (radius
[r
].state
== RADIUSAUTH
)
480 // run post-auth plugin
481 struct param_post_auth packet
= {
485 (r_code
== AccessAccept
),
486 radius
[r
].chap
? PPPCHAP
: PPPPAP
489 run_plugins(PLUGIN_POST_AUTH
, &packet
);
490 r_code
= packet
.auth_allowed
? AccessAccept
: AccessReject
;
492 // process auth response
496 uint8_t *p
= makeppp(b
, sizeof(b
), 0, 0, t
, s
, PPPCHAP
);
497 if (!p
) return; // Abort!
499 *p
= (r_code
== AccessAccept
) ? 3 : 4; // ack/nak
501 *(uint16_t *) (p
+ 2) = ntohs(4); // no message
502 tunnelsend(b
, (p
- b
) + 4, t
); // send it
504 LOG(3, s
, session
[s
].tunnel
, " CHAP User %s authentication %s.\n", session
[s
].user
,
505 (r_code
== AccessAccept
) ? "allowed" : "denied");
510 uint8_t *p
= makeppp(b
, sizeof(b
), 0, 0, t
, s
, PPPPAP
);
511 if (!p
) return; // Abort!
516 *(uint16_t *) (p
+ 2) = ntohs(5);
517 p
[4] = 0; // no message
518 tunnelsend(b
, (p
- b
) + 5, t
); // send it
520 LOG(3, s
, session
[s
].tunnel
, " PAP User %s authentication %s.\n", session
[s
].user
,
521 (r_code
== AccessAccept
) ? "allowed" : "denied");
524 if (r_code
== AccessAccept
)
527 // Extract IP, routes, etc
528 uint8_t *p
= buf
+ 20;
529 uint8_t *e
= buf
+ len
;
530 for (; p
+ 2 <= e
&& p
[1] && p
+ p
[1] <= e
; p
+= p
[1])
535 if (p
[1] < 6) continue;
536 session
[s
].ip
= ntohl(*(uint32_t *) (p
+ 2));
537 session
[s
].ip_pool_index
= -1;
538 LOG(3, s
, session
[s
].tunnel
, " Radius reply contains IP address %s\n",
539 fmtaddr(htonl(session
[s
].ip
), 0));
541 if (session
[s
].ip
== 0xFFFFFFFE)
542 session
[s
].ip
= 0; // assign from pool
547 if (p
[1] < 6) continue;
548 session
[s
].dns1
= ntohl(*(uint32_t *) (p
+ 2));
549 LOG(3, s
, session
[s
].tunnel
, " Radius reply contains primary DNS address %s\n",
550 fmtaddr(htonl(session
[s
].dns1
), 0));
555 if (p
[1] < 6) continue;
556 session
[s
].dns2
= ntohl(*(uint32_t *) (p
+ 2));
557 LOG(3, s
, session
[s
].tunnel
, " Radius reply contains secondary DNS address %s\n",
558 fmtaddr(htonl(session
[s
].dns2
), 0));
563 in_addr_t ip
= 0, mask
= 0;
567 uint8_t *e
= p
+ p
[1];
568 while (n
< e
&& (isdigit(*n
) || *n
== '.'))
576 u
= u
* 10 + *n
- '0';
583 while (n
< e
&& isdigit(*n
))
584 bits
= bits
* 10 + *n
++ - '0';
585 mask
= (( -1) << (32 - bits
));
587 else if ((ip
>> 24) < 128)
589 else if ((ip
>> 24) < 192)
594 if (routes
== MAXROUTE
)
596 LOG(1, s
, session
[s
].tunnel
, " Too many routes\n");
600 LOG(3, s
, session
[s
].tunnel
, " Radius reply contains route for %s/%s\n",
601 fmtaddr(htonl(ip
), 0), fmtaddr(htonl(mask
), 1));
603 session
[s
].route
[routes
].ip
= ip
;
604 session
[s
].route
[routes
].mask
= mask
;
611 char *filter
= (char *) p
+ 2;
617 LOG(3, s
, session
[s
].tunnel
, " Radius reply contains Filter-Id \"%.*s\"\n", l
, filter
);
618 if ((suffix
= memchr(filter
, '.', l
)))
620 int b
= suffix
- filter
;
621 if (l
- b
== 3 && !memcmp("in", suffix
+1, 2))
622 fp
= &session
[s
].filter_in
;
623 else if (l
- b
== 4 && !memcmp("out", suffix
+1, 3))
624 fp
= &session
[s
].filter_out
;
631 LOG(3, s
, session
[s
].tunnel
, " Invalid filter\n");
635 if ((f
= find_filter(filter
, l
)) < 0 || !*ip_filters
[f
].name
)
637 LOG(3, s
, session
[s
].tunnel
, " Unknown filter\n");
642 ip_filters
[f
].used
++;
645 else if (*p
== 26 && p
[1] >= 7)
647 // Vendor-Specific Attribute
648 int vendor
= ntohl(*(int *)(p
+ 2));
649 char attrib
= *(p
+ 6);
650 int attrib_length
= *(p
+ 7) - 2;
652 LOG(3, s
, session
[s
].tunnel
, " Radius reply contains Vendor-Specific. Vendor=%d Attrib=%d Length=%d\n", vendor
, attrib
, attrib_length
);
653 if (vendor
!= 9 || attrib
!= 1)
655 LOG(3, s
, session
[s
].tunnel
, " Unknown vendor-specific\n");
659 if (attrib_length
> 0)
661 LOG(3, s
, session
[s
].tunnel
, " Cisco-AVPair value: %.*s\n",
662 attrib_length
, p
+ 8);
664 handle_avpair(s
, p
+ 8, attrib_length
);
673 uint8_t *e
= p
+ p
[1];
674 uint8_t *m
= memchr(n
, '/', e
- p
);
677 inet_pton(AF_INET6
, (char *) n
, &r6
);
680 while (m
< e
&& isdigit(*m
)) {
681 prefixlen
= prefixlen
* 10 + *m
++ - '0';
686 LOG(3, s
, session
[s
].tunnel
,
687 " Radius reply contains route for %s/%d\n",
689 session
[s
].ipv6route
= r6
;
690 session
[s
].ipv6prefixlen
= prefixlen
;
695 else if (r_code
== AccessReject
)
697 LOG(2, s
, session
[s
].tunnel
, " Authentication rejected for %s\n", session
[s
].user
);
698 sessionkill(s
, "Authentication rejected");
702 if (!session
[s
].dns1
&& config
->default_dns1
)
704 session
[s
].dns1
= ntohl(config
->default_dns1
);
705 LOG(3, s
, t
, " Sending dns1 = %s\n", fmtaddr(config
->default_dns1
, 0));
707 if (!session
[s
].dns2
&& config
->default_dns2
)
709 session
[s
].dns2
= ntohl(config
->default_dns2
);
710 LOG(3, s
, t
, " Sending dns2 = %s\n", fmtaddr(config
->default_dns2
, 0));
713 // Valid Session, set it up
714 session
[s
].unique_id
= 0;
719 // An ack for a stop or start record.
720 LOG(3, s
, t
, " RADIUS accounting ack recv in state %s\n", radius_state(radius
[r
].state
));
725 // finished with RADIUS
729 // Send a retry for RADIUS/CHAP message
730 void radiusretry(uint16_t r
)
732 sessionidt s
= radius
[r
].session
;
737 if (s
) t
= session
[s
].tunnel
;
739 switch (radius
[r
].state
)
741 case RADIUSCHAP
: // sending CHAP down PPP
744 case RADIUSAUTH
: // sending auth to RADIUS server
745 case RADIUSSTART
: // sending start accounting to RADIUS server
746 case RADIUSSTOP
: // sending stop accounting to RADIUS server
747 case RADIUSINTERIM
: // sending interim accounting to RADIUS server
748 radiussend(r
, radius
[r
].state
);
751 case RADIUSNULL
: // Not in use
752 case RADIUSWAIT
: // waiting timeout before available, in case delayed reply from RADIUS server
753 // free up RADIUS task
755 LOG(3, s
, session
[s
].tunnel
, "Freeing up radius session %d\n", r
);
762 void processdae(uint8_t *buf
, int len
, struct sockaddr_in
*addr
, int alen
)
764 int i
, r_code
, r_id
, length
, attribute_length
;
765 uint8_t vector
[16], hash
[16], *packet
, attribute
;
767 char username
[MAXUSER
] = "";
777 int avpair_len
[sizeof(avpair
)/sizeof(*avpair
)];
782 LOG(3, 0, 0, "DAE request from %s\n", fmtaddr(addr
->sin_addr
.s_addr
, 0));
783 LOG_HEX(5, "DAE Request", buf
, len
);
785 if (len
< 20 || len
< ntohs(*(uint16_t *) (buf
+ 2)))
787 LOG(1, 0, 0, "Duff DAE request length %d\n", len
);
791 r_code
= buf
[0]; // request type
792 r_id
= buf
[1]; // radius indentifier.
794 if (r_code
!= DisconnectRequest
&& r_code
!= CoARequest
)
796 LOG(1, 0, 0, "Unrecognised DAE request %s\n", radius_code(r_code
));
800 if (!config
->cluster_iam_master
)
802 master_forward_dae_packet(buf
, len
, addr
->sin_addr
.s_addr
, addr
->sin_port
);
806 len
= ntohs(*(uint16_t *) (buf
+ 2));
808 LOG(3, 0, 0, "Received DAE %s, id %d\n", radius_code(r_code
), r_id
);
810 // check authenticator
811 memcpy(vector
, buf
+ 4, 16);
812 memset(buf
+ 4, 0, 16);
814 i
= strlen(config
->radiussecret
);
818 MD5_Update(&ctx
, buf
, len
);
819 MD5_Update(&ctx
, config
->radiussecret
, i
);
820 MD5_Final(hash
, &ctx
);
821 if (memcmp(hash
, vector
, 16) != 0)
823 LOG(1, 0, 0, "Incorrect vector in DAE request (wrong secret in radius config?)\n");
833 attribute
= *packet
++;
834 attribute_length
= *packet
++;
835 if (attribute_length
< 2)
838 length
-= attribute_length
;
839 attribute_length
-= 2;
842 case 1: /* username */
843 len
= attribute_length
< MAXUSER
? attribute_length
: MAXUSER
- 1;
844 memcpy(username
, packet
, len
);
846 LOG(4, 0, 0, " Received DAE User-Name: %s\n", username
);
849 case 4: /* nas ip address */
850 nas
= *(uint32_t *) packet
; // net order
851 if (nas
!= config
->bind_address
)
852 error
= 403; // NAS identification mismatch
854 LOG(4, 0, 0, " Received DAE NAS-IP-Address: %s\n", fmtaddr(nas
, 0));
857 case 5: /* nas port */
858 port
= ntohl(*(uint32_t *) packet
);
859 if (port
< 1 || port
> MAXSESSION
)
862 LOG(4, 0, 0, " Received DAE NAS-Port: %u\n", port
);
865 case 6: /* service type */
867 uint32_t service_type
= ntohl(*(uint32_t *) packet
);
868 auth_only
= service_type
== 8; // Authenticate only
870 LOG(4, 0, 0, " Received DAE Service-Type: %u\n", service_type
);
874 case 8: /* ip address */
875 ip
= *(uint32_t *) packet
; // net order
876 LOG(4, 0, 0, " Received DAE Framed-IP-Address: %s\n", fmtaddr(ip
, 0));
879 case 11: /* filter id */
880 LOG(4, 0, 0, " Received DAE Filter-Id: %.*s\n", attribute_length
, packet
);
881 if (!(p
= memchr(packet
, '.', attribute_length
)))
883 error
= 404; // invalid request
888 i
= find_filter((char *) packet
, len
);
889 if (i
< 0 || !*ip_filters
[i
].name
)
895 if (!memcmp(p
, ".in", attribute_length
- len
))
897 else if (!memcmp(p
, ".out", attribute_length
- len
))
904 case 26: /* vendor specific */
905 if (attribute_length
>= 6
906 && ntohl(*(uint32_t *) packet
) == 9 // Cisco
907 && *(packet
+ 4) == 1 // Cisco-AVPair
908 && *(packet
+ 5) >= 2) // length
910 int len
= *(packet
+ 5) - 2;
911 uint8_t *a
= packet
+ 6;
913 LOG(4, 0, 0, " Received DAE Cisco-AVPair: %.*s\n", len
, a
);
914 if (avp
< sizeof(avpair
)/sizeof(*avpair
) - 1)
917 avpair_len
[avp
++] = len
;
923 packet
+= attribute_length
;
926 if (!error
&& auth_only
)
928 if (fin
!= -1 || fout
!= -1 || avp
)
929 error
= 401; // unsupported attribute
931 error
= 405; // unsupported service
934 if (!error
&& !(port
|| ip
|| *username
))
935 error
= 402; // missing attribute
937 // exact match for SID if given
941 if (!session
[s
].opened
)
942 error
= 503; // not found
947 // find/check session by IP
949 if (!i
|| (s
&& s
!= i
)) // not found or mismatching port
955 if (!error
&& *username
)
959 if (strcmp(session
[s
].user
, username
))
962 else if (!(s
= sessionbyuser(username
)))
966 t
= session
[s
].tunnel
;
970 case DisconnectRequest
: // Packet of Disconnect/Death
973 r_code
= DisconnectNAK
;
977 LOG(3, s
, t
, " DAE Disconnect %d (%s)\n", s
, session
[s
].user
);
978 r_code
= DisconnectACK
;
980 sessionshutdown(s
, "Requested by PoD", 3, 0); // disconnect session
983 case CoARequest
: // Change of Authorization
990 LOG(3, s
, t
, " DAE Change %d (%s)\n", s
, session
[s
].user
);
995 struct param_radius_reset p
= { &tunnel
[session
[s
].tunnel
], &session
[s
] };
996 run_plugins(PLUGIN_RADIUS_RESET
, &p
);
1003 LOG(3, s
, t
, " Filter in %d (%s)\n", fin
, ip_filters
[fin
- 1].name
);
1008 LOG(3, s
, t
, " Filter out %d (%s)\n", fout
, ip_filters
[fout
- 1].name
);
1010 filter_session(s
, fin
, fout
);
1012 // process cisco av-pair(s)
1013 for (i
= 0; i
< avp
; i
++)
1015 LOG(3, s
, t
, " Cisco-AVPair: %.*s\n", avpair_len
[i
], avpair
[i
]);
1016 handle_avpair(s
, avpair
[i
], avpair_len
[i
]);
1019 cluster_send_session(s
);
1028 memset(packet
, 0, 16);
1038 *(uint32_t *) packet
= htonl(error
);
1042 *((uint16_t *)(buf
+ 2)) = htons(len
);
1045 i
= strlen(config
->radiussecret
);
1049 MD5_Update(&ctx
, buf
, len
);
1050 MD5_Update(&ctx
, config
->radiussecret
, i
);
1051 MD5_Final(hash
, &ctx
);
1052 memcpy(buf
+ 4, hash
, 16);
1054 LOG(3, 0, 0, "Sending DAE %s, id=%d\n", radius_code(r_code
), r_id
);
1056 // send DAE response
1057 if (sendto(daefd
, buf
, len
, MSG_DONTWAIT
| MSG_NOSIGNAL
, (struct sockaddr
*) addr
, alen
) < 0)
1058 LOG(0, 0, 0, "Error sending DAE response packet: %s\n", strerror(errno
));