2 // $Id: radius.c,v 1.2 2004-03-05 00:09:03 fred_nerk Exp $
7 #include <sys/socket.h>
10 #include <arpa/inet.h>
12 #include <netinet/in.h>
14 #include "constants.h"
19 extern radiust
*radius
;
20 extern sessiont
*session
;
21 extern tunnelt
*tunnel
;
24 extern struct Tstats
*_statistics
;
25 extern struct configt
*config
;
27 const char *radius_state(int state
)
29 static char *tmp
= NULL
;
31 for (i
= 0; radius_states
[i
]; i
++)
32 if (i
== state
) return radius_states
[i
];
34 if (tmp
== NULL
) tmp
= (char *)calloc(64, 1);
35 sprintf(tmp
, "%d", state
);
39 // Set up socket for radius requests
42 radfd
= socket(AF_INET
, SOCK_DGRAM
, UDP
);
45 void radiusclear(u8 r
, sessionidt s
)
47 if (s
) session
[s
].radius
= 0;
48 memset(&radius
[r
], 0, sizeof(radius
[r
])); // radius[r].state = RADIUSNULL;
51 static u8
new_radius()
54 for (i
= 1; i
< MAXRADIUS
; i
++)
56 if (radius
[i
].state
== RADIUSNULL
)
59 log(0, 0, 0, 0, "Can't find a free radius session! This could be bad!\n");
63 u8
radiusnew(sessionidt s
)
66 if (!(r
= new_radius()))
68 log(1, 0, s
, session
[s
].tunnel
, "No free RADIUS sessions\n");
69 STAT(radius_overflow
);
72 memset(&radius
[r
], 0, sizeof(radius
[r
]));
73 session
[s
].radius
= r
;
74 radius
[r
].session
= s
;
75 radius
[r
].state
= RADIUSWAIT
;
79 // Send a RADIUS request
80 void radiussend(u8 r
, u8 state
)
82 struct sockaddr_in addr
;
83 u8 b
[4096]; // RADIUS packet
89 STAT(call_radiussend
);
91 s
= radius
[r
].session
;
92 if (!config
->numradiusservers
)
94 log(0, 0, s
, session
[s
].tunnel
, "No RADIUS servers\n");
97 if (!*config
->radiussecret
)
99 log(0, 0, s
, session
[s
].tunnel
, "No RADIUS secret\n");
103 if (state
!= RADIUSAUTH
&& !config
->radius_accounting
)
105 // Radius accounting is turned off
110 if (radius
[r
].state
!= state
)
112 radius
[r
].state
= state
;
113 radius
[r
].retry
= backoff(radius
[r
].try++);
114 log(4, 0, s
, session
[s
].tunnel
, "Send RADIUS %d state %s try %d\n", r
, radius_state(radius
[r
].state
), radius
[r
].try);
115 if (radius
[r
].try > config
->numradiusservers
* 2)
119 sessionshutdown(s
, "RADIUS timeout");
120 STAT(radius_timeout
);
124 STAT(radius_retries
);
125 radius
[r
].state
= RADIUSWAIT
;
126 radius
[r
].retry
= 100;
130 // contruct RADIUS access request
134 b
[0] = 1; // access request
138 b
[0] = 4; // accounting request
141 log(0, 0, 0, 0, "Unknown radius state %d\n", state
);
143 b
[1] = r
; // identifier
144 memcpy(b
+ 4, radius
[r
].auth
, 16);
149 p
[1] = strlen(session
[s
].user
) + 2;
150 strcpy(p
+ 2, session
[s
].user
);
153 if (state
== RADIUSAUTH
)
157 *p
= 3; // CHAP password
159 p
[2] = radius
[r
].id
; // ID
160 memcpy(p
+ 3, radius
[r
].pass
, 16); // response from CHAP request
162 *p
= 60; // CHAP Challenge
164 memcpy(p
+ 2, radius
[r
].auth
, 16);
169 strcpy(pass
, radius
[r
].pass
);
172 pass
[pl
++] = 0; // pad
181 MD5Update(&ctx
, config
->radiussecret
, strlen(config
->radiussecret
));
183 MD5Update(&ctx
, pass
+ p
- 16, 16);
185 MD5Update(&ctx
, radius
[r
].auth
, 16);
186 MD5Final(hash
, &ctx
);
189 pass
[p
] ^= hash
[p
& 15];
198 memcpy(p
+ 2, pass
, pl
);
202 else if (state
== RADIUSSTART
|| state
== RADIUSSTOP
)
204 *p
= 40; // accounting type
206 *(u32
*) (p
+ 2) = htonl((state
== RADIUSSTART
) ? 1 : 2);
210 *p
= 44; // session ID
212 sprintf(p
+ 2, "%08X%08X", session
[s
].id
, session
[s
].opened
);
214 if (state
== RADIUSSTOP
)
216 *p
= 42; // input octets
218 *(u32
*) (p
+ 2) = htonl(session
[s
].cin
);
220 *p
= 43; // output octets
222 *(u32
*) (p
+ 2) = htonl(session
[s
].cout
);
224 *p
= 46; // session time
226 *(u32
*) (p
+ 2) = htonl(time(NULL
) - session
[s
].opened
);
228 *p
= 47; // input packets
230 *(u32
*) (p
+ 2) = htonl(session
[s
].pin
);
232 *p
= 48; // output spackets
234 *(u32
*) (p
+ 2) = htonl(session
[s
].pout
);
241 *(u32
*) (p
+ 2) = htonl(time(NULL
) - session
[s
].opened
);
250 *(u32
*) (p
+ 2) = htonl(s
);
253 if (s
&& session
[s
].ip
)
255 *p
= 8; // Framed-IP-Address
257 *(u32
*) (p
+ 2) = htonl(session
[s
].ip
);
260 if (*session
[s
].called
)
263 p
[1] = strlen(session
[s
].called
) + 2;
264 strcpy(p
+ 2, session
[s
].called
);
267 if (*radius
[r
].calling
)
270 p
[1] = strlen(radius
[r
].calling
) + 2;
271 strcpy(p
+ 2, radius
[r
].calling
);
274 else if (*session
[s
].calling
)
277 p
[1] = strlen(session
[s
].calling
) + 2;
278 strcpy(p
+ 2, session
[s
].calling
);
284 *(u32
*)(p
+ 2) = config
->bind_address
;
288 *(u16
*) (b
+ 2) = htons(p
- b
);
289 if (state
!= RADIUSAUTH
)
291 // Build auth for accounting packet
296 MD5Update(&ctx
, b
, 4);
297 MD5Update(&ctx
, z
, 16);
298 MD5Update(&ctx
, b
+ 20, (p
- b
) - 20);
299 MD5Update(&ctx
, config
->radiussecret
, strlen(config
->radiussecret
));
300 MD5Final(hash
, &ctx
);
301 memcpy(b
+ 4, hash
, 16);
302 memcpy(radius
[r
].auth
, hash
, 16);
304 memset(&addr
, 0, sizeof(addr
));
305 addr
.sin_family
= AF_INET
;
306 *(u32
*) & addr
.sin_addr
= config
->radiusserver
[(radius
[r
].try - 1) % config
->numradiusservers
];
307 addr
.sin_port
= htons((state
== RADIUSAUTH
) ? RADPORT
: RADAPORT
);
309 log_hex(5, "RADIUS Send", b
, (p
- b
));
310 sendto(radfd
, b
, p
- b
, 0, (void *) &addr
, sizeof(addr
));
313 // process RADIUS response
314 void processrad(u8
* buf
, int len
)
325 STAT(call_processrad
);
327 log_hex(5, "RADIUS Response", buf
, len
);
328 if (len
< 20 || len
< ntohs(*(u16
*) (buf
+ 2)))
330 log(1, 0, 0, 0, "Duff RADIUS response length %d\n", len
);
333 len
= ntohs(*(u16
*) (buf
+ 2));
335 s
= radius
[r
].session
;
336 log(3, 0, s
, session
[s
].tunnel
, "Received %s, radius %d response for session %u\n", radius_states
[radius
[r
].state
], r
, s
);
337 if (!s
&& radius
[r
].state
!= RADIUSSTOP
)
339 log(1, 0, s
, session
[s
].tunnel
, " Unexpected RADIUS response\n");
342 if (radius
[r
].state
!= RADIUSAUTH
&& radius
[r
].state
!= RADIUSSTART
&& radius
[r
].state
!= RADIUSSTOP
)
344 log(1, 0, s
, session
[s
].tunnel
, " Unexpected RADIUS response\n");
347 t
= session
[s
].tunnel
;
349 MD5Update(&ctx
, buf
, 4);
350 MD5Update(&ctx
, radius
[r
].auth
, 16);
351 MD5Update(&ctx
, buf
+ 20, len
- 20);
352 MD5Update(&ctx
, config
->radiussecret
, strlen(config
->radiussecret
));
353 MD5Final(hash
, &ctx
);
355 if (memcmp(hash
, buf
+ 4, 16))
357 log(0, 0, s
, session
[s
].tunnel
, " Incorrect auth on RADIUS response\n");
358 radius
[r
].state
= RADIUSWAIT
;
361 if ((radius
[r
].state
== RADIUSAUTH
&& *buf
!= 2 && *buf
!= 3) ||
362 ((radius
[r
].state
== RADIUSSTART
|| radius
[r
].state
== RADIUSSTOP
) && *buf
!= 5))
364 log(1, 0, s
, session
[s
].tunnel
, " Unexpected RADIUS response %d\n", *buf
);
365 radius
[r
].state
= RADIUSWAIT
;
368 if (radius
[r
].state
== RADIUSAUTH
)
370 log(4, 0, s
, session
[s
].tunnel
, " Original response is \"%s\"\n", (*buf
== 2) ? "accept" : "reject");
371 // process auth response
375 u8
*p
= makeppp(b
, 0, 0, t
, s
, PPPCHAP
);
378 struct param_post_auth packet
= { &tunnel
[t
], &session
[s
], session
[s
].user
, (*buf
== 2), PPPCHAP
};
379 run_plugins(PLUGIN_POST_AUTH
, &packet
);
380 *buf
= packet
.auth_allowed
? 2 : 3;
383 log(3, 0, s
, session
[s
].tunnel
, " CHAP User %s authentication %s.\n", session
[s
].user
,
384 (*buf
== 2) ? "allowed" : "denied");
385 *p
= (*buf
== 2) ? 3 : 4; // ack/nak
387 *(u16
*) (p
+ 2) = ntohs(4); // no message
388 tunnelsend(b
, (p
- b
) + 4, t
); // send it
393 u8
*p
= makeppp(b
, 0, 0, t
, s
, PPPPAP
);
396 struct param_post_auth packet
= { &tunnel
[t
], &session
[s
], session
[s
].user
, (*buf
== 2), PPPPAP
};
397 run_plugins(PLUGIN_POST_AUTH
, &packet
);
398 *buf
= packet
.auth_allowed
? 2 : 3;
401 log(3, 0, s
, session
[s
].tunnel
, " PAP User %s authentication %s.\n", session
[s
].user
,
402 (*buf
== 2) ? "allowed" : "denied");
406 *(u16
*) (p
+ 2) = ntohs(5);
407 p
[4] = 0; // no message
408 tunnelsend(b
, (p
- b
) + 5, t
); // send it
414 // Extract IP, routes, etc
417 for (p
= buf
+ 20; p
< e
&& p
[1]; p
+= p
[1])
421 // Statically assigned address
422 log(3, 0, s
, session
[s
].tunnel
, " Radius reply contains IP address %s\n", inet_toa(*(u32
*) (p
+ 2)));
423 session
[s
].ip
= ntohl(*(u32
*) (p
+ 2));
428 log(3, 0, s
, session
[s
].tunnel
, " Radius reply contains primary DNS address %s\n", inet_toa(ntohl(*(u32
*) (p
+ 2))));
429 session
[s
].dns1
= ntohl(*(u32
*) (p
+ 2));
434 log(3, 0, s
, session
[s
].tunnel
, " Radius reply contains secondary DNS address %s\n", inet_toa(ntohl(*(u32
*) (p
+ 2))));
435 session
[s
].dns2
= ntohl(*(u32
*) (p
+ 2));
440 ipt ip
= 0, mask
= 0;
445 while (n
< e
&& (isdigit(*n
) || *n
== '.'))
453 u
= u
* 10 + *n
- '0';
460 while (n
< e
&& isdigit(*n
))
461 bits
= bits
* 10 + *n
++ - '0';
462 mask
= (( -1) << (32 - bits
));
464 else if ((ip
>> 24) < 128)
466 else if ((ip
>> 24) < 192)
470 if (routes
== MAXROUTE
)
472 log(1, 0, s
, session
[s
].tunnel
, " Too many routes\n");
476 log(3, 0, s
, session
[s
].tunnel
, " Radius reply contains route for %d/%d\n",
479 session
[s
].route
[routes
].ip
= ip
;
480 session
[s
].route
[routes
].mask
= mask
;
486 // Vendor-Specific Attribute
487 int vendor
= ntohl(*(int *)(p
+ 2));
488 char attrib
= *(p
+ 6);
489 char attrib_length
= *(p
+ 7) - 2;
490 log(3, 0, s
, session
[s
].tunnel
, " Radius reply contains Vendor-Specific. Vendor=%d Attrib=%d Length=%d\n", vendor
, attrib
, attrib_length
);
491 if (attrib_length
== 0) continue;
493 log(3, 0, s
, session
[s
].tunnel
, " Unknown vendor-specific\n");
496 char *avpair
, *value
, *key
, *newp
;
497 avpair
= key
= calloc(attrib_length
+ 1, 1);
498 memcpy(avpair
, p
+ 8, attrib_length
);
499 log(3, 0, s
, session
[s
].tunnel
, " Cisco-Avpair value: %s\n", avpair
);
501 value
= strchr(key
, '=');
505 // Trim quotes off reply string
506 if (*value
== '\'' || *value
== '\"')
510 x
= value
+ strlen(value
) - 1;
511 if (*x
== '\'' || *x
== '\"')
516 newp
= strchr(value
, ',');
517 if (newp
) *newp
++ = 0;
519 struct param_radius_response p
= { &tunnel
[session
[s
].tunnel
], &session
[s
], key
, value
};
520 run_plugins(PLUGIN_RADIUS_RESPONSE
, &p
);
531 log(2, 0, s
, session
[s
].tunnel
, " Authentication denied for %s\n", session
[s
].user
);
535 // Check for Assign-IP-Address
536 if (!session
[s
].ip
|| session
[s
].ip
== 0xFFFFFFFE)
538 assign_ip_address(s
);
540 log(3, 0, s
, t
, " No IP allocated by radius. Assigned %s from pool\n",
541 inet_toa(htonl(session
[s
].ip
)));
543 log(3, 0, s
, t
, " No IP allocated by radius. None available in pool\n");
545 if (!session
[s
].dns1
&& config
->default_dns1
)
547 session
[s
].dns1
= htonl(config
->default_dns1
);
548 log(3, 0, s
, t
, " Sending dns1 = %s\n", inet_toa(config
->default_dns1
));
550 if (!session
[s
].dns2
&& config
->default_dns2
)
552 session
[s
].dns2
= htonl(config
->default_dns2
);
553 log(3, 0, s
, t
, " Sending dns2 = %s\n", inet_toa(config
->default_dns2
));
558 // Valid Session, set it up
560 sessionsetup(t
, s
, routes
);
564 log(0, 0, s
, t
, " End of processrad(), but no valid session exists.\n");
565 sessionkill(s
, "Can't create valid session");
570 log(3, 0, s
, t
, " RADIUS response in state %d\n", radius
[r
].state
);
574 // finished with RADIUS
578 // Send a retry for RADIUS/CHAP message
579 void radiusretry(u8 r
)
581 sessionidt s
= radius
[r
].session
;
584 STAT(call_radiusretry
);
587 t
= session
[s
].tunnel
;
589 switch (radius
[r
].state
)
591 case RADIUSCHAP
: // sending CHAP down PPP
595 sendipcp(t
, s
); // send IPCP
597 case RADIUSAUTH
: // sending auth to RADIUS server
598 radiussend(r
, RADIUSAUTH
);
600 case RADIUSSTART
: // sending start accounting to RADIUS server
601 radiussend(r
, RADIUSSTART
);
603 case RADIUSSTOP
: // sending stop accounting to RADIUS server
604 radiussend(r
, RADIUSSTOP
);
607 case RADIUSNULL
: // Not in use
608 case RADIUSWAIT
: // waiting timeout before available, in case delayed reply from RADIUS server
609 // free up RADIUS task
611 log(3, 0, s
, session
[s
].tunnel
, "Freeing up radius session %d\n", r
);
620 log(1, 0, 0, 0, "Cleaning radius session array\n");
622 for (i
= 1; i
< MAXRADIUS
; i
++)
624 if (radius
[i
].retry
== 0
625 || !session
[radius
[i
].session
].opened
626 || session
[radius
[i
].session
].die
627 || session
[radius
[i
].session
].tunnel
== 0)