3 char const *cvs_id_radius
= "$Id: radius.c,v 1.49 2006/04/13 11:14:35 bodea Exp $";
8 #include <sys/socket.h>
12 #include <arpa/inet.h>
14 #include <netinet/in.h>
17 #include "constants.h"
23 extern radiust
*radius
;
24 extern sessiont
*session
;
25 extern tunnelt
*tunnel
;
26 extern configt
*config
;
28 extern ip_filtert
*ip_filters
;
30 static const hasht zero
;
32 static void calc_auth(const void *buf
, size_t len
, const uint8_t *in
, uint8_t *out
)
37 MD5_Update(&ctx
, (void *)buf
, 4); // code, id, length
38 MD5_Update(&ctx
, (void *)in
, 16); // auth
39 MD5_Update(&ctx
, (void *)(buf
+ 20), len
- 20);
40 MD5_Update(&ctx
, config
->radiussecret
, strlen(config
->radiussecret
));
44 // Set up socket for radius requests
48 LOG(3, 0, 0, "Creating %d sockets for RADIUS queries\n", RADIUS_FDS
);
49 radfds
= calloc(sizeof(int), RADIUS_FDS
);
50 for (i
= 0; i
< RADIUS_FDS
; i
++)
53 radfds
[i
] = socket(AF_INET
, SOCK_DGRAM
, IPPROTO_UDP
);
54 flags
= fcntl(radfds
[i
], F_GETFL
, 0);
55 fcntl(radfds
[i
], F_SETFL
, flags
| O_NONBLOCK
);
59 void radiusclear(uint16_t r
, sessionidt s
)
61 if (s
) sess_local
[s
].radius
= 0;
62 memset(&radius
[r
], 0, sizeof(radius
[r
])); // radius[r].state = RADIUSNULL;
65 static uint16_t get_free_radius()
68 static uint32_t next_radius_id
= 0;
70 for (count
= MAXRADIUS
; count
> 0; --count
)
72 ++next_radius_id
; // Find the next ID to check.
73 if (next_radius_id
>= MAXRADIUS
)
76 if (radius
[next_radius_id
].state
== RADIUSNULL
)
78 return next_radius_id
;
82 LOG(0, 0, 0, "Can't find a free radius session! This is very bad!\n");
86 uint16_t radiusnew(sessionidt s
)
88 uint16_t r
= sess_local
[s
].radius
;
93 LOG(3, s
, session
[s
].tunnel
, "Re-used radius %d\n", r
);
97 if (!(r
= get_free_radius()))
99 LOG(1, s
, session
[s
].tunnel
, "No free RADIUS sessions\n");
100 STAT(radius_overflow
);
104 memset(&radius
[r
], 0, sizeof(radius
[r
]));
105 sess_local
[s
].radius
= r
;
106 radius
[r
].session
= s
;
107 radius
[r
].state
= RADIUSWAIT
;
108 radius
[r
].retry
= TIME
+ 1200; // Wait at least 120 seconds to re-claim this.
110 random_data(radius
[r
].auth
, sizeof(radius
[r
].auth
));
112 LOG(3, s
, session
[s
].tunnel
, "Allocated radius %d\n", r
);
116 // Send a RADIUS request
117 void radiussend(uint16_t r
, uint8_t state
)
119 struct sockaddr_in addr
;
120 uint8_t b
[4096]; // RADIUS packet
128 s
= radius
[r
].session
;
129 if (!config
->numradiusservers
)
131 LOG(0, s
, session
[s
].tunnel
, "No RADIUS servers\n");
134 if (!*config
->radiussecret
)
136 LOG(0, s
, session
[s
].tunnel
, "No RADIUS secret\n");
140 if (state
!= RADIUSAUTH
&& !config
->radius_accounting
)
142 // Radius accounting is turned off
147 if (radius
[r
].state
!= state
)
150 radius
[r
].state
= state
;
151 radius
[r
].retry
= backoff(radius
[r
].try++) + 20; // 3s, 4s, 6s, 10s...
152 LOG(4, s
, session
[s
].tunnel
, "Send RADIUS id %d sock %d state %s try %d\n",
153 r
>> RADIUS_SHIFT
, r
& RADIUS_MASK
,
154 radius_state(radius
[r
].state
), radius
[r
].try);
156 if (radius
[r
].try > config
->numradiusservers
* 2)
160 if (state
== RADIUSAUTH
)
161 sessionshutdown(s
, "RADIUS timeout.", CDN_ADMIN_DISC
, TERM_REAUTHENTICATION_FAILURE
);
164 LOG(1, s
, session
[s
].tunnel
, "RADIUS timeout, but in state %s so don't timeout session\n",
165 radius_state(state
));
168 STAT(radius_timeout
);
172 STAT(radius_retries
);
173 radius
[r
].state
= RADIUSWAIT
;
174 radius
[r
].retry
= 100;
178 // contruct RADIUS access request
182 b
[0] = AccessRequest
; // access request
187 b
[0] = AccountingRequest
; // accounting request
190 LOG(0, 0, 0, "Unknown radius state %d\n", state
);
192 b
[1] = r
>> RADIUS_SHIFT
; // identifier
193 memcpy(b
+ 4, radius
[r
].auth
, 16);
198 p
[1] = strlen(session
[s
].user
) + 2;
199 strcpy((char *) p
+ 2, session
[s
].user
);
202 if (state
== RADIUSAUTH
)
206 *p
= 3; // CHAP password
208 p
[2] = radius
[r
].id
; // ID
209 memcpy(p
+ 3, radius
[r
].pass
, 16); // response from CHAP request
211 *p
= 60; // CHAP Challenge
213 memcpy(p
+ 2, radius
[r
].auth
, 16);
218 strcpy(pass
, radius
[r
].pass
);
221 pass
[pl
++] = 0; // pad
230 MD5_Update(&ctx
, config
->radiussecret
, strlen(config
->radiussecret
));
232 MD5_Update(&ctx
, pass
+ p
- 16, 16);
234 MD5_Update(&ctx
, radius
[r
].auth
, 16);
235 MD5_Final(hash
, &ctx
);
238 pass
[p
] ^= hash
[p
& 15];
247 memcpy(p
+ 2, pass
, pl
);
253 *p
= 40; // accounting type
255 *(uint32_t *) (p
+ 2) = htonl(state
- RADIUSSTART
+ 1); // start=1, stop=2, interim=3
259 *p
= 44; // session ID
261 sprintf((char *) p
+ 2, "%08X%08X", session
[s
].unique_id
, session
[s
].opened
);
263 if (state
== RADIUSSTART
)
267 *(uint32_t *) (p
+ 2) = htonl(time(NULL
) - session
[s
].opened
);
269 sess_local
[s
].last_interim
= time_now
; // Setup "first" Interim
273 *p
= 42; // input octets
275 *(uint32_t *) (p
+ 2) = htonl(session
[s
].cin
);
278 *p
= 43; // output octets
280 *(uint32_t *) (p
+ 2) = htonl(session
[s
].cout
);
283 *p
= 46; // session time
285 *(uint32_t *) (p
+ 2) = htonl(time(NULL
) - session
[s
].opened
);
288 *p
= 47; // input packets
290 *(uint32_t *) (p
+ 2) = htonl(session
[s
].pin
);
293 *p
= 48; // output packets
295 *(uint32_t *) (p
+ 2) = htonl(session
[s
].pout
);
298 *p
= 52; // input gigawords
300 *(uint32_t *) (p
+ 2) = htonl(session
[s
].cin_wrap
);
303 *p
= 53; // output gigawords
305 *(uint32_t *) (p
+ 2) = htonl(session
[s
].cout_wrap
);
308 if (state
== RADIUSSTOP
&& radius
[r
].term_cause
)
310 *p
= 49; // acct-terminate-cause
312 *(uint32_t *) (p
+ 2) = htonl(radius
[r
].term_cause
);
315 if (radius
[r
].term_msg
)
317 *p
= 26; // vendor-specific
318 *(uint32_t *) (p
+ 2) = htonl(9); // Cisco
319 p
[6] = 1; // Cisco-AVPair
320 p
[7] = 2 + sprintf((char *) p
+ 8, "disc-cause-ext=%s", radius
[r
].term_msg
);
328 struct param_radius_account acct
= { &tunnel
[session
[s
].tunnel
], &session
[s
], &p
};
329 run_plugins(PLUGIN_RADIUS_ACCOUNT
, &acct
);
337 *(uint32_t *) (p
+ 2) = htonl(s
);
340 *p
= 6; // Service-Type
342 *(uint32_t *) (p
+ 2) = htonl(2); // Framed-User
345 *p
= 7; // Framed-Protocol
347 *(uint32_t *) (p
+ 2) = htonl(1); // PPP
350 if (s
&& session
[s
].ip
)
352 *p
= 8; // Framed-IP-Address
354 *(uint32_t *) (p
+ 2) = htonl(session
[s
].ip
);
357 if (s
&& session
[s
].route
[0].ip
)
360 for (r
= 0; s
&& r
< MAXROUTE
&& session
[s
].route
[r
].ip
; r
++)
363 if (session
[s
].route
[r
].mask
)
365 int mask
= session
[s
].route
[r
].mask
;
373 *p
= 22; // Framed-Route
374 p
[1] = sprintf((char *) p
+ 2, "%s/%d %s 1",
375 fmtaddr(htonl(session
[s
].route
[r
].ip
), 0),
376 width
, fmtaddr(htonl(session
[s
].ip
), 1)) + 2;
381 if (*session
[s
].called
)
384 p
[1] = strlen(session
[s
].called
) + 2;
385 strcpy((char *) p
+ 2, session
[s
].called
);
388 if (*session
[s
].calling
)
391 p
[1] = strlen(session
[s
].calling
) + 2;
392 strcpy((char *) p
+ 2, session
[s
].calling
);
398 *(uint32_t *)(p
+ 2) = config
->bind_address
;
402 *(uint16_t *) (b
+ 2) = htons(p
- b
);
403 if (state
!= RADIUSAUTH
)
405 // Build auth for accounting packet
406 calc_auth(b
, p
- b
, zero
, b
+ 4);
407 memcpy(radius
[r
].auth
, b
+ 4, 16);
409 memset(&addr
, 0, sizeof(addr
));
410 addr
.sin_family
= AF_INET
;
411 *(uint32_t *) & addr
.sin_addr
= config
->radiusserver
[(radius
[r
].try - 1) % config
->numradiusservers
];
414 uint16_t port
= config
->radiusport
[(radius
[r
].try - 1) % config
->numradiusservers
];
415 // assume RADIUS accounting port is the authentication port +1
416 addr
.sin_port
= htons((state
== RADIUSAUTH
) ? port
: port
+1);
419 LOG_HEX(5, "RADIUS Send", b
, (p
- b
));
420 sendto(radfds
[r
& RADIUS_MASK
], b
, p
- b
, 0, (void *) &addr
, sizeof(addr
));
423 static void handle_avpair(sessionidt s
, uint8_t *avp
, int len
)
426 uint8_t *value
= memchr(avp
, '=', len
);
427 uint8_t tmp
[2048] = "";
441 if (len
> 2 && (*value
== '"' || *value
== '\'') && value
[len
- 1] == *value
)
447 // copy and null terminate
448 else if (len
< sizeof(tmp
) - 1)
450 memcpy(tmp
, value
, len
);
459 struct param_radius_response p
= { &tunnel
[session
[s
].tunnel
], &session
[s
], (char *) key
, (char *) value
};
460 run_plugins(PLUGIN_RADIUS_RESPONSE
, &p
);
464 // process RADIUS response
465 void processrad(uint8_t *buf
, int len
, char socket_index
)
478 LOG_HEX(5, "RADIUS Response", buf
, len
);
479 if (len
< 20 || len
< ntohs(*(uint16_t *) (buf
+ 2)))
481 LOG(1, 0, 0, "Duff RADIUS response length %d\n", len
);
485 r_code
= buf
[0]; // response type
486 r_id
= buf
[1]; // radius reply indentifier.
488 len
= ntohs(*(uint16_t *) (buf
+ 2));
489 r
= socket_index
| (r_id
<< RADIUS_SHIFT
);
490 s
= radius
[r
].session
;
491 LOG(3, s
, session
[s
].tunnel
, "Received %s, radius %d response for session %u (%s, id %d)\n",
492 radius_state(radius
[r
].state
), r
, s
, radius_code(r_code
), r_id
);
494 if (!s
&& radius
[r
].state
!= RADIUSSTOP
)
496 LOG(1, s
, session
[s
].tunnel
, " Unexpected RADIUS response\n");
499 if (radius
[r
].state
!= RADIUSAUTH
&& radius
[r
].state
!= RADIUSSTART
500 && radius
[r
].state
!= RADIUSSTOP
&& radius
[r
].state
!= RADIUSINTERIM
)
502 LOG(1, s
, session
[s
].tunnel
, " Unexpected RADIUS response\n");
505 t
= session
[s
].tunnel
;
506 calc_auth(buf
, len
, radius
[r
].auth
, hash
);
508 if (memcmp(hash
, buf
+ 4, 16))
510 LOG(0, s
, session
[s
].tunnel
, " Incorrect auth on RADIUS response!! (wrong secret in radius config?)\n");
511 return; // Do nothing. On timeout, it will try the next radius server.
514 if ((radius
[r
].state
== RADIUSAUTH
&& r_code
!= AccessAccept
&& r_code
!= AccessReject
) ||
515 ((radius
[r
].state
== RADIUSSTART
|| radius
[r
].state
== RADIUSSTOP
|| radius
[r
].state
== RADIUSINTERIM
) && r_code
!= AccountingResponse
))
517 LOG(1, s
, session
[s
].tunnel
, " Unexpected RADIUS response %s\n", radius_code(r_code
));
518 return; // We got something we didn't expect. Let the timeouts take
519 // care off finishing the radius session if that's really correct.
522 if (radius
[r
].state
== RADIUSAUTH
)
524 // run post-auth plugin
525 struct param_post_auth packet
= {
529 (r_code
== AccessAccept
),
530 radius
[r
].chap
? PPPCHAP
: PPPPAP
533 run_plugins(PLUGIN_POST_AUTH
, &packet
);
534 r_code
= packet
.auth_allowed
? AccessAccept
: AccessReject
;
536 // process auth response
540 uint8_t *p
= makeppp(b
, sizeof(b
), 0, 0, s
, t
, PPPCHAP
);
541 if (!p
) return; // Abort!
543 *p
= (r_code
== AccessAccept
) ? 3 : 4; // ack/nak
545 *(uint16_t *) (p
+ 2) = ntohs(4); // no message
546 tunnelsend(b
, (p
- b
) + 4, t
); // send it
548 LOG(3, s
, session
[s
].tunnel
, " CHAP User %s authentication %s.\n", session
[s
].user
,
549 (r_code
== AccessAccept
) ? "allowed" : "denied");
554 uint8_t *p
= makeppp(b
, sizeof(b
), 0, 0, s
, t
, PPPPAP
);
555 if (!p
) return; // Abort!
560 *(uint16_t *) (p
+ 2) = ntohs(5);
561 p
[4] = 0; // no message
562 tunnelsend(b
, (p
- b
) + 5, t
); // send it
564 LOG(3, s
, session
[s
].tunnel
, " PAP User %s authentication %s.\n", session
[s
].user
,
565 (r_code
== AccessAccept
) ? "allowed" : "denied");
568 if (r_code
== AccessAccept
)
571 // Extract IP, routes, etc
572 uint8_t *p
= buf
+ 20;
573 uint8_t *e
= buf
+ len
;
574 for (; p
+ 2 <= e
&& p
[1] && p
+ p
[1] <= e
; p
+= p
[1])
579 if (p
[1] < 6) continue;
580 session
[s
].ip
= ntohl(*(uint32_t *) (p
+ 2));
581 session
[s
].ip_pool_index
= -1;
582 LOG(3, s
, session
[s
].tunnel
, " Radius reply contains IP address %s\n",
583 fmtaddr(htonl(session
[s
].ip
), 0));
585 if (session
[s
].ip
== 0xFFFFFFFE)
586 session
[s
].ip
= 0; // assign from pool
591 if (p
[1] < 6) continue;
592 session
[s
].dns1
= ntohl(*(uint32_t *) (p
+ 2));
593 LOG(3, s
, session
[s
].tunnel
, " Radius reply contains primary DNS address %s\n",
594 fmtaddr(htonl(session
[s
].dns1
), 0));
599 if (p
[1] < 6) continue;
600 session
[s
].dns2
= ntohl(*(uint32_t *) (p
+ 2));
601 LOG(3, s
, session
[s
].tunnel
, " Radius reply contains secondary DNS address %s\n",
602 fmtaddr(htonl(session
[s
].dns2
), 0));
607 in_addr_t ip
= 0, mask
= 0;
611 uint8_t *e
= p
+ p
[1];
612 while (n
< e
&& (isdigit(*n
) || *n
== '.'))
620 u
= u
* 10 + *n
- '0';
627 while (n
< e
&& isdigit(*n
))
628 bits
= bits
* 10 + *n
++ - '0';
629 mask
= (( -1) << (32 - bits
));
631 else if ((ip
>> 24) < 128)
633 else if ((ip
>> 24) < 192)
638 if (routes
== MAXROUTE
)
640 LOG(1, s
, session
[s
].tunnel
, " Too many routes\n");
644 LOG(3, s
, session
[s
].tunnel
, " Radius reply contains route for %s/%s\n",
645 fmtaddr(htonl(ip
), 0), fmtaddr(htonl(mask
), 1));
647 session
[s
].route
[routes
].ip
= ip
;
648 session
[s
].route
[routes
].mask
= mask
;
655 char *filter
= (char *) p
+ 2;
661 LOG(3, s
, session
[s
].tunnel
, " Radius reply contains Filter-Id \"%.*s\"\n", l
, filter
);
662 if ((suffix
= memchr(filter
, '.', l
)))
664 int b
= suffix
- filter
;
665 if (l
- b
== 3 && !memcmp("in", suffix
+1, 2))
666 fp
= &session
[s
].filter_in
;
667 else if (l
- b
== 4 && !memcmp("out", suffix
+1, 3))
668 fp
= &session
[s
].filter_out
;
675 LOG(3, s
, session
[s
].tunnel
, " Invalid filter\n");
679 if ((f
= find_filter(filter
, l
)) < 0 || !*ip_filters
[f
].name
)
681 LOG(3, s
, session
[s
].tunnel
, " Unknown filter\n");
686 ip_filters
[f
].used
++;
689 else if (*p
== 26 && p
[1] >= 7)
691 // Vendor-Specific Attribute
692 int vendor
= ntohl(*(int *)(p
+ 2));
693 char attrib
= *(p
+ 6);
694 int attrib_length
= *(p
+ 7) - 2;
696 LOG(3, s
, session
[s
].tunnel
, " Radius reply contains Vendor-Specific. Vendor=%d Attrib=%d Length=%d\n", vendor
, attrib
, attrib_length
);
697 if (vendor
!= 9 || attrib
!= 1)
699 LOG(3, s
, session
[s
].tunnel
, " Unknown vendor-specific\n");
703 if (attrib_length
> 0)
705 LOG(3, s
, session
[s
].tunnel
, " Cisco-AVPair value: %.*s\n",
706 attrib_length
, p
+ 8);
708 handle_avpair(s
, p
+ 8, attrib_length
);
717 uint8_t *e
= p
+ p
[1];
718 uint8_t *m
= memchr(n
, '/', e
- p
);
721 inet_pton(AF_INET6
, (char *) n
, &r6
);
724 while (m
< e
&& isdigit(*m
)) {
725 prefixlen
= prefixlen
* 10 + *m
++ - '0';
730 LOG(3, s
, session
[s
].tunnel
,
731 " Radius reply contains route for %s/%d\n",
733 session
[s
].ipv6route
= r6
;
734 session
[s
].ipv6prefixlen
= prefixlen
;
739 else if (r_code
== AccessReject
)
741 LOG(2, s
, session
[s
].tunnel
, " Authentication rejected for %s\n", session
[s
].user
);
742 sessionkill(s
, "Authentication rejected");
746 if (!session
[s
].dns1
&& config
->default_dns1
)
748 session
[s
].dns1
= ntohl(config
->default_dns1
);
749 LOG(3, s
, t
, " Sending dns1 = %s\n", fmtaddr(config
->default_dns1
, 0));
751 if (!session
[s
].dns2
&& config
->default_dns2
)
753 session
[s
].dns2
= ntohl(config
->default_dns2
);
754 LOG(3, s
, t
, " Sending dns2 = %s\n", fmtaddr(config
->default_dns2
, 0));
757 // Valid Session, set it up
758 session
[s
].unique_id
= 0;
763 // An ack for a stop or start record.
764 LOG(3, s
, t
, " RADIUS accounting ack recv in state %s\n", radius_state(radius
[r
].state
));
769 // finished with RADIUS
773 // Send a retry for RADIUS/CHAP message
774 void radiusretry(uint16_t r
)
776 sessionidt s
= radius
[r
].session
;
781 if (s
) t
= session
[s
].tunnel
;
783 switch (radius
[r
].state
)
785 case RADIUSCHAP
: // sending CHAP down PPP
788 case RADIUSAUTH
: // sending auth to RADIUS server
789 case RADIUSSTART
: // sending start accounting to RADIUS server
790 case RADIUSSTOP
: // sending stop accounting to RADIUS server
791 case RADIUSINTERIM
: // sending interim accounting to RADIUS server
792 radiussend(r
, radius
[r
].state
);
795 case RADIUSNULL
: // Not in use
796 case RADIUSWAIT
: // waiting timeout before available, in case delayed reply from RADIUS server
797 // free up RADIUS task
799 LOG(3, s
, session
[s
].tunnel
, "Freeing up radius session %d\n", r
);
806 void processdae(uint8_t *buf
, int len
, struct sockaddr_in
*addr
, int alen
, struct in_addr
*local
)
808 int i
, r_code
, r_id
, length
, attribute_length
;
809 uint8_t *packet
, attribute
;
811 char username
[MAXUSER
] = "";
821 int avpair_len
[sizeof(avpair
)/sizeof(*avpair
)];
826 LOG(3, 0, 0, "DAE request from %s\n", fmtaddr(addr
->sin_addr
.s_addr
, 0));
827 LOG_HEX(5, "DAE Request", buf
, len
);
829 if (len
< 20 || len
< ntohs(*(uint16_t *) (buf
+ 2)))
831 LOG(1, 0, 0, "Duff DAE request length %d\n", len
);
835 r_code
= buf
[0]; // request type
836 r_id
= buf
[1]; // radius indentifier.
838 if (r_code
!= DisconnectRequest
&& r_code
!= CoARequest
)
840 LOG(1, 0, 0, "Unrecognised DAE request %s\n", radius_code(r_code
));
844 if (!config
->cluster_iam_master
)
846 master_forward_dae_packet(buf
, len
, addr
->sin_addr
.s_addr
, addr
->sin_port
);
850 len
= ntohs(*(uint16_t *) (buf
+ 2));
852 LOG(3, 0, 0, "Received DAE %s, id %d\n", radius_code(r_code
), r_id
);
854 // check authenticator
855 calc_auth(buf
, len
, zero
, hash
);
856 if (memcmp(hash
, buf
+ 4, 16) != 0)
858 LOG(1, 0, 0, "Incorrect vector in DAE request (wrong secret in radius config?)\n");
868 attribute
= *packet
++;
869 attribute_length
= *packet
++;
870 if (attribute_length
< 2)
873 length
-= attribute_length
;
874 attribute_length
-= 2;
877 case 1: /* username */
878 len
= attribute_length
< MAXUSER
? attribute_length
: MAXUSER
- 1;
879 memcpy(username
, packet
, len
);
881 LOG(4, 0, 0, " Received DAE User-Name: %s\n", username
);
884 case 4: /* nas ip address */
885 nas
= *(uint32_t *) packet
; // net order
886 if (nas
!= config
->bind_address
)
887 error
= 403; // NAS identification mismatch
889 LOG(4, 0, 0, " Received DAE NAS-IP-Address: %s\n", fmtaddr(nas
, 0));
892 case 5: /* nas port */
893 port
= ntohl(*(uint32_t *) packet
);
894 if (port
< 1 || port
> MAXSESSION
)
897 LOG(4, 0, 0, " Received DAE NAS-Port: %u\n", port
);
900 case 6: /* service type */
902 uint32_t service_type
= ntohl(*(uint32_t *) packet
);
903 auth_only
= service_type
== 8; // Authenticate only
905 LOG(4, 0, 0, " Received DAE Service-Type: %u\n", service_type
);
909 case 8: /* ip address */
910 ip
= *(uint32_t *) packet
; // net order
911 LOG(4, 0, 0, " Received DAE Framed-IP-Address: %s\n", fmtaddr(ip
, 0));
914 case 11: /* filter id */
915 LOG(4, 0, 0, " Received DAE Filter-Id: %.*s\n", attribute_length
, packet
);
916 if (!(p
= memchr(packet
, '.', attribute_length
)))
918 error
= 404; // invalid request
923 i
= find_filter((char *) packet
, len
);
924 if (i
< 0 || !*ip_filters
[i
].name
)
930 if (!memcmp(p
, ".in", attribute_length
- len
))
932 else if (!memcmp(p
, ".out", attribute_length
- len
))
939 case 26: /* vendor specific */
940 if (attribute_length
>= 6
941 && ntohl(*(uint32_t *) packet
) == 9 // Cisco
942 && *(packet
+ 4) == 1 // Cisco-AVPair
943 && *(packet
+ 5) >= 2) // length
945 int len
= *(packet
+ 5) - 2;
946 uint8_t *a
= packet
+ 6;
948 LOG(4, 0, 0, " Received DAE Cisco-AVPair: %.*s\n", len
, a
);
949 if (avp
< sizeof(avpair
)/sizeof(*avpair
) - 1)
952 avpair_len
[avp
++] = len
;
958 packet
+= attribute_length
;
961 if (!error
&& auth_only
)
963 if (fin
!= -1 || fout
!= -1 || avp
)
964 error
= 401; // unsupported attribute
966 error
= 405; // unsupported service
969 if (!error
&& !(port
|| ip
|| *username
))
970 error
= 402; // missing attribute
972 // exact match for SID if given
976 if (!session
[s
].opened
)
977 error
= 503; // not found
982 // find/check session by IP
984 if (!i
|| (s
&& s
!= i
)) // not found or mismatching port
990 if (!error
&& *username
)
994 if (strcmp(session
[s
].user
, username
))
997 else if (!(s
= sessionbyuser(username
)))
1001 t
= session
[s
].tunnel
;
1005 case DisconnectRequest
: // Packet of Disconnect/Death
1008 r_code
= DisconnectNAK
;
1012 LOG(3, s
, t
, " DAE Disconnect %d (%s)\n", s
, session
[s
].user
);
1013 r_code
= DisconnectACK
;
1015 sessionshutdown(s
, "Requested by PoD", CDN_ADMIN_DISC
, TERM_ADMIN_RESET
); // disconnect session
1018 case CoARequest
: // Change of Authorization
1025 LOG(3, s
, t
, " DAE Change %d (%s)\n", s
, session
[s
].user
);
1030 struct param_radius_reset p
= { &tunnel
[session
[s
].tunnel
], &session
[s
] };
1031 run_plugins(PLUGIN_RADIUS_RESET
, &p
);
1038 LOG(3, s
, t
, " Filter in %d (%s)\n", fin
, ip_filters
[fin
- 1].name
);
1043 LOG(3, s
, t
, " Filter out %d (%s)\n", fout
, ip_filters
[fout
- 1].name
);
1045 filter_session(s
, fin
, fout
);
1047 // process cisco av-pair(s)
1048 for (i
= 0; i
< avp
; i
++)
1050 LOG(3, s
, t
, " Cisco-AVPair: %.*s\n", avpair_len
[i
], avpair
[i
]);
1051 handle_avpair(s
, avpair
[i
], avpair_len
[i
]);
1054 cluster_send_session(s
);
1072 *(uint32_t *) packet
= htonl(error
);
1076 *((uint16_t *)(buf
+ 2)) = htons(len
);
1079 calc_auth(buf
, len
, hash
, buf
+ 4);
1081 LOG(3, 0, 0, "Sending DAE %s, id=%d\n", radius_code(r_code
), r_id
);
1083 // send DAE response
1084 if (sendtofrom(daefd
, buf
, len
, MSG_DONTWAIT
| MSG_NOSIGNAL
, (struct sockaddr
*) addr
, alen
, local
) < 0)
1085 LOG(0, 0, 0, "Error sending DAE response packet: %s\n", strerror(errno
));