1 /***********************************************************************
5 * RADIUS plugin for pppd. Performs PAP, CHAP, MS-CHAP, MS-CHAPv2
6 * authentication using RADIUS.
8 * Copyright (C) 2002 Roaring Penguin Software Inc.
10 * Based on a patch for ipppd, which is:
11 * Copyright (C) 1996, Matjaz Godec <gody@elgo.si>
12 * Copyright (C) 1996, Lars Fenneberg <in5y050@public.uni-hamburg.de>
13 * Copyright (C) 1997, Miguel A.L. Paraz <map@iphil.net>
15 * Uses radiusclient library, which is:
16 * Copyright (C) 1995,1996,1997,1998 Lars Fenneberg <lf@elemental.net>
17 * Copyright (C) 2002 Roaring Penguin Software Inc.
19 * MPPE support is by Ralf Hofmann, <ralf.hofmann@elvido.net>, with
20 * modification from Frank Cusack, <frank@google.com>.
22 * This plugin may be distributed according to the terms of the GNU
23 * General Public License, version 2 or (at your option) any later version.
25 ***********************************************************************/
26 static char const RCSID[] =
27 "$Id: radius.c,v 1.14 2002/09/01 08:56:01 kad Exp $";
37 #include "radiusclient.h"
41 #include <sys/types.h>
46 static char *config_file = NULL;
48 static option_t Options[] = {
49 { "radius-config-file", o_string, &config_file },
53 static int radius_secret_check(void);
54 static int radius_pap_auth(char *user,
57 struct wordlist **paddrs,
58 struct wordlist **popts);
59 static int radius_chap_auth(char *user,
64 static void radius_ip_up(void *opaque, int arg);
65 static void radius_ip_down(void *opaque, int arg);
66 static void make_username_realm(char *user);
67 static int radius_setparams(chap_state *cstate, VALUE_PAIR *vp, char *msg,
68 REQUEST_INFO *req_info);
69 static void radius_choose_ip(u_int32_t *addrp);
70 static int radius_init(char *msg);
71 static int get_client_port(char *ifname);
72 static int radius_allowed_address(u_int32_t addr);
73 static void radius_acct_interim(void *);
75 static int radius_setmppekeys(VALUE_PAIR *vp, REQUEST_INFO *req_info,
77 static int radius_setmppekeys2(VALUE_PAIR *vp, REQUEST_INFO *req_info);
81 #define MAXSESSIONID 32
85 int accounting_started;
92 char user[MAXNAMELEN];
93 char config_file[MAXPATHLEN];
94 char session_id[MAXSESSIONID + 1];
96 int acct_interim_interval;
97 SERVER *authserver; /* Authentication server to use */
98 SERVER *acctserver; /* Accounting server to use */
101 void (*radius_attributes_hook)(VALUE_PAIR *) = NULL;
103 /* The pre_auth_hook MAY set authserver and acctserver if it wants.
104 In that case, they override the values in the radiusclient.conf file */
105 void (*radius_pre_auth_hook)(char const *user,
107 SERVER **acctserver) = NULL;
109 static struct radius_state rstate;
111 char pppd_version[] = VERSION;
113 /**********************************************************************
114 * %FUNCTION: plugin_init
120 * Initializes RADIUS plugin.
121 ***********************************************************************/
125 pap_check_hook = radius_secret_check;
126 pap_auth_hook = radius_pap_auth;
128 chap_check_hook = radius_secret_check;
129 chap_auth_hook = radius_chap_auth;
131 ip_choose_hook = radius_choose_ip;
132 allowed_address_hook = radius_allowed_address;
134 add_notifier(&ip_up_notifier, radius_ip_up, NULL);
135 add_notifier(&ip_down_notifier, radius_ip_down, NULL);
137 memset(&rstate, 0, sizeof(rstate));
139 strlcpy(rstate.config_file, "/etc/radiusclient/radiusclient.conf",
140 sizeof(rstate.config_file));
142 add_options(Options);
144 info("RADIUS plugin initialized.");
147 /**********************************************************************
148 * %FUNCTION: radius_secret_check
152 * 1 -- we are ALWAYS willing to supply a secret. :-)
154 * Tells pppd that we will try to authenticate the peer, and not to
155 * worry about looking in /etc/ppp/*-secrets
156 ***********************************************************************/
158 radius_secret_check(void)
163 /**********************************************************************
164 * %FUNCTION: radius_choose_ip
166 * addrp -- where to store the IP address
170 * If RADIUS server has specified an IP address, it is stored in *addrp.
171 ***********************************************************************/
173 radius_choose_ip(u_int32_t *addrp)
175 if (rstate.choose_ip) {
176 *addrp = rstate.ip_addr;
180 /**********************************************************************
181 * %FUNCTION: radius_pap_auth
183 * user -- user-name of peer
184 * passwd -- password supplied by peer
185 * msgp -- Message which will be sent in PAP response
186 * paddrs -- set to a list of possible peer IP addresses
187 * popts -- set to a list of additional pppd options
189 * 1 if we can authenticate, -1 if we cannot.
191 * Performs PAP authentication using RADIUS
192 ***********************************************************************/
194 radius_pap_auth(char *user,
197 struct wordlist **paddrs,
198 struct wordlist **popts)
200 VALUE_PAIR *send, *received;
203 static char radius_msg[BUF_LEN];
208 if (radius_init(radius_msg) < 0) {
212 /* Put user with potentially realm added in rstate.user */
213 make_username_realm(user);
215 if (radius_pre_auth_hook) {
216 radius_pre_auth_hook(rstate.user,
224 /* Hack... the "port" is the ppp interface number. Should really be
226 rstate.client_port = get_client_port(ifname);
229 rc_avpair_add(&send, PW_SERVICE_TYPE, &av_type, 0, VENDOR_NONE);
232 rc_avpair_add(&send, PW_FRAMED_PROTOCOL, &av_type, 0, VENDOR_NONE);
234 rc_avpair_add(&send, PW_USER_NAME, rstate.user , 0, VENDOR_NONE);
235 rc_avpair_add(&send, PW_USER_PASSWORD, passwd, 0, VENDOR_NONE);
236 if (*remote_number) {
237 rc_avpair_add(&send, PW_CALLING_STATION_ID, remote_number, 0,
241 if (rstate.authserver) {
242 result = rc_auth_using_server(rstate.authserver,
243 rstate.client_port, send,
244 &received, radius_msg, NULL);
246 result = rc_auth(rstate.client_port, send, &received, radius_msg, NULL);
249 if (result == OK_RC) {
250 if (radius_setparams(NULL, received, radius_msg, NULL) < 0) {
255 /* free value pairs */
256 rc_avpair_free(received);
257 rc_avpair_free(send);
259 return (result == OK_RC) ? 1 : 0;
262 /**********************************************************************
263 * %FUNCTION: radius_chap_auth
265 * user -- user-name of peer
266 * remmd -- hash received from peer
267 * remmd_len -- length of remmd
268 * cstate -- pppd's chap_state structure
270 * CHAP_SUCCESS if we can authenticate, CHAP_FAILURE if we cannot.
272 * Performs CHAP, MS-CHAP and MS-CHAPv2 authentication using RADIUS.
273 ***********************************************************************/
275 radius_chap_auth(char *user,
280 VALUE_PAIR *send, *received;
282 static char radius_msg[BUF_LEN];
284 u_char cpassword[MAX_RESPONSE_LENGTH + 1];
286 /* Need the RADIUS secret and Request Authenticator to decode MPPE */
287 REQUEST_INFO request_info, *req_info = &request_info;
289 REQUEST_INFO *req_info = NULL;
294 if (radius_init(radius_msg) < 0) {
295 error("%s", radius_msg);
299 /* return error for types we can't handle */
300 if ((cstate->chal_type != CHAP_DIGEST_MD5)
302 && (cstate->chal_type != CHAP_MICROSOFT)
303 && (cstate->chal_type != CHAP_MICROSOFT_V2)
306 error("RADIUS: Challenge type %u unsupported", cstate->chal_type);
310 /* Put user with potentially realm added in rstate.user */
311 if (!rstate.done_chap_once) {
312 make_username_realm(user);
313 rstate.client_port = get_client_port (ifname);
314 if (radius_pre_auth_hook) {
315 radius_pre_auth_hook(rstate.user,
321 send = received = NULL;
324 rc_avpair_add (&send, PW_SERVICE_TYPE, &av_type, 0, VENDOR_NONE);
327 rc_avpair_add (&send, PW_FRAMED_PROTOCOL, &av_type, 0, VENDOR_NONE);
329 rc_avpair_add (&send, PW_USER_NAME, rstate.user , 0, VENDOR_NONE);
332 * add the challenge and response fields
334 switch (cstate->chal_type) {
335 case CHAP_DIGEST_MD5:
336 /* CHAP-Challenge and CHAP-Password */
337 cpassword[0] = cstate->chal_id;
338 memcpy(&cpassword[1], remmd, MD5_SIGNATURE_SIZE);
340 rc_avpair_add(&send, PW_CHAP_CHALLENGE,
341 cstate->challenge, cstate->chal_len, VENDOR_NONE);
342 rc_avpair_add(&send, PW_CHAP_PASSWORD,
343 cpassword, MD5_SIGNATURE_SIZE + 1, VENDOR_NONE);
349 /* MS-CHAP-Challenge and MS-CHAP-Response */
350 MS_ChapResponse *rmd = (MS_ChapResponse *) remmd;
351 u_char *p = cpassword;
353 *p++ = cstate->chal_id;
354 /* The idiots use a different field order in RADIUS than PPP */
355 memcpy(p, rmd->UseNT, sizeof(rmd->UseNT));
356 p += sizeof(rmd->UseNT);
357 memcpy(p, rmd->LANManResp, sizeof(rmd->LANManResp));
358 p += sizeof(rmd->LANManResp);
359 memcpy(p, rmd->NTResp, sizeof(rmd->NTResp));
361 rc_avpair_add(&send, PW_MS_CHAP_CHALLENGE,
362 cstate->challenge, cstate->chal_len, VENDOR_MICROSOFT);
363 rc_avpair_add(&send, PW_MS_CHAP_RESPONSE,
364 cpassword, MS_CHAP_RESPONSE_LEN + 1, VENDOR_MICROSOFT);
368 case CHAP_MICROSOFT_V2:
370 /* MS-CHAP-Challenge and MS-CHAP2-Response */
371 MS_Chap2Response *rmd = (MS_Chap2Response *) remmd;
372 u_char *p = cpassword;
374 *p++ = cstate->chal_id;
375 /* The idiots use a different field order in RADIUS than PPP */
376 memcpy(p, rmd->Flags, sizeof(rmd->Flags));
377 p += sizeof(rmd->Flags);
378 memcpy(p, rmd->PeerChallenge, sizeof(rmd->PeerChallenge));
379 p += sizeof(rmd->PeerChallenge);
380 memcpy(p, rmd->Reserved, sizeof(rmd->Reserved));
381 p += sizeof(rmd->Reserved);
382 memcpy(p, rmd->NTResp, sizeof(rmd->NTResp));
384 rc_avpair_add(&send, PW_MS_CHAP_CHALLENGE,
385 cstate->challenge, cstate->chal_len, VENDOR_MICROSOFT);
386 rc_avpair_add(&send, PW_MS_CHAP2_RESPONSE,
387 cpassword, MS_CHAP2_RESPONSE_LEN + 1, VENDOR_MICROSOFT);
395 * make authentication with RADIUS server
398 if (rstate.authserver) {
399 result = rc_auth_using_server(rstate.authserver,
400 rstate.client_port, send,
401 &received, radius_msg, req_info);
403 result = rc_auth(rstate.client_port, send, &received, radius_msg,
407 if (result == OK_RC) {
408 if (!rstate.done_chap_once) {
409 if (radius_setparams(cstate, received, radius_msg, req_info) < 0) {
410 error("%s", radius_msg);
413 rstate.done_chap_once = 1;
418 rc_avpair_free(received);
419 rc_avpair_free (send);
420 return (result == OK_RC) ? CHAP_SUCCESS : CHAP_FAILURE;
423 /**********************************************************************
424 * %FUNCTION: make_username_realm
426 * user -- the user given to pppd
430 * Copies user into rstate.user. If it lacks a realm (no "@domain" part),
431 * then the default realm from the radiusclient config file is added.
432 ***********************************************************************/
434 make_username_realm(char *user)
438 if ( user != NULL ) {
439 strlcpy(rstate.user, user, sizeof(rstate.user));
444 default_realm = rc_conf_str("default_realm");
446 if (!strchr(rstate.user, '@') &&
448 (*default_realm != '\0')) {
449 strlcat(rstate.user, "@", sizeof(rstate.user));
450 strlcat(rstate.user, default_realm, sizeof(rstate.user));
454 /**********************************************************************
455 * %FUNCTION: radius_setparams
457 * cstate -- pppd's chap_state structure
458 * vp -- received value-pairs
459 * msg -- buffer in which to place error message. Holds up to BUF_LEN chars
461 * >= 0 on success; -1 on failure
463 * Parses attributes sent by RADIUS server and sets them in pppd.
464 ***********************************************************************/
466 radius_setparams(chap_state *cstate, VALUE_PAIR *vp, char *msg,
467 REQUEST_INFO *req_info)
470 int ms_chap2_success = 0;
472 /* Send RADIUS attributes to anyone else who might be interested */
473 if (radius_attributes_hook) {
474 (*radius_attributes_hook)(vp);
478 * service type (if not framed then quit),
479 * new IP address (RADIUS can define static IP for some users),
483 if (vp->vendorcode == VENDOR_NONE) {
484 switch (vp->attribute) {
485 case PW_SERVICE_TYPE:
486 /* check for service type */
487 /* if not FRAMED then exit */
488 if (vp->lvalue != PW_FRAMED) {
489 slprintf(msg, BUF_LEN, "RADIUS: wrong service type %ld for %s",
490 vp->lvalue, rstate.user);
495 case PW_FRAMED_PROTOCOL:
496 /* check for framed protocol type */
497 /* if not PPP then also exit */
498 if (vp->lvalue != PW_PPP) {
499 slprintf(msg, BUF_LEN, "RADIUS: wrong framed protocol %ld for %s",
500 vp->lvalue, rstate.user);
505 case PW_SESSION_TIMEOUT:
506 /* Session timeout */
507 maxconnect = vp->lvalue;
510 case PW_SESSION_OCTETS_LIMIT:
511 /* Session traffic limit */
512 maxoctets = vp->lvalue;
514 case PW_OCTETS_DIRECTION:
515 /* Session traffic limit direction check */
516 maxoctets_dir = ( vp->lvalue > 4 ) ? 0 : vp->lvalue ;
519 case PW_ACCT_INTERIM_INTERVAL:
520 /* Send accounting updates every few seconds */
521 rstate.acct_interim_interval = vp->lvalue;
522 /* RFC says it MUST NOT be less than 60 seconds */
523 /* We use "0" to signify not sending updates */
524 if (rstate.acct_interim_interval &&
525 rstate.acct_interim_interval < 60) {
526 rstate.acct_interim_interval = 60;
529 case PW_FRAMED_IP_ADDRESS:
530 /* seting up remote IP addresses */
532 if (remote == 0xffffffff) {
533 /* 0xffffffff means user should be allowed to select one */
534 rstate.any_ip_addr_ok = 1;
535 } else if (remote != 0xfffffffe) {
536 /* 0xfffffffe means NAS should select an ip address */
537 remote = htonl(vp->lvalue);
538 if (bad_ip_adrs (remote)) {
539 slprintf(msg, BUF_LEN, "RADIUS: bad remote IP address %I for %s",
540 remote, rstate.user);
543 rstate.choose_ip = 1;
544 rstate.ip_addr = remote;
549 } else if (vp->vendorcode == VENDOR_MICROSOFT) {
550 switch (vp->attribute) {
551 case PW_MS_CHAP2_SUCCESS:
552 if ((vp->lvalue != 43) || strncmp(vp->strvalue + 1, "S=", 2)) {
553 slprintf(msg,BUF_LEN,"RADIUS: bad MS-CHAP2-Success packet");
556 memcpy(cstate->saresponse, vp->strvalue + 3,
557 MS_AUTH_RESPONSE_LENGTH);
558 cstate->saresponse[MS_AUTH_RESPONSE_LENGTH] = '\0';
559 ms_chap2_success = 1;
563 case PW_MS_CHAP_MPPE_KEYS:
564 if (radius_setmppekeys(vp, req_info, cstate) < 0) {
565 slprintf(msg, BUF_LEN,
566 "RADIUS: bad MS-CHAP-MPPE-Keys attribute");
571 case PW_MS_MPPE_SEND_KEY:
572 case PW_MS_MPPE_RECV_KEY:
573 if (radius_setmppekeys2(vp, req_info) < 0) {
574 slprintf(msg, BUF_LEN,
575 "RADIUS: bad MS-MPPE-%s-Key attribute",
576 (vp->attribute == PW_MS_MPPE_SEND_KEY)?
583 case PW_MS_MPPE_ENCRYPTION_POLICY:
584 case PW_MS_MPPE_ENCRYPTION_TYPES:
585 case PW_MS_PRIMARY_DNS_SERVER:
586 case PW_MS_SECONDARY_DNS_SERVER:
587 case PW_MS_PRIMARY_NBNS_SERVER:
588 case PW_MS_SECONDARY_NBNS_SERVER:
597 /* Require a valid MS-CHAP2-SUCCESS for MS-CHAPv2 auth */
598 if (cstate && (cstate->chal_type == CHAP_MICROSOFT_V2) && !ms_chap2_success)
605 /**********************************************************************
606 * %FUNCTION: radius_setmppekeys
608 * vp -- value pair holding MS-CHAP-MPPE-KEYS attribute
609 * req_info -- radius request information used for encryption
610 * cstate -- chap_state structure for challenge info
612 * >= 0 on success; -1 on failure
614 * Decrypt the "key" provided by the RADIUS server for MPPE encryption.
616 ***********************************************************************/
618 radius_setmppekeys(VALUE_PAIR *vp, REQUEST_INFO *req_info, chap_state *cstate)
625 if (vp->lvalue != 32) {
626 error("RADIUS: Incorrect attribute length (%d) for MS-CHAP-MPPE-Keys",
631 memcpy(plain, vp->strvalue, sizeof(plain));
634 MD5Update(&Context, req_info->secret, strlen(req_info->secret));
635 MD5Update(&Context, req_info->request_vector, AUTH_VECTOR_LEN);
636 MD5Final(buf, &Context);
638 for (i = 0; i < 16; i++)
642 MD5Update(&Context, req_info->secret, strlen(req_info->secret));
643 MD5Update(&Context, vp->strvalue, 16);
644 MD5Final(buf, &Context);
646 for(i = 0; i < 16; i++)
647 plain[i + 16] ^= buf[i];
650 * Annoying. The "key" returned is just the NTPasswordHashHash, which
651 * the NAS (us) doesn't need; we only need the start key. So we have
652 * to generate the start key, sigh. NB: We do not support the LM-Key.
654 mppe_set_keys(cstate->challenge, &plain[8]);
659 /**********************************************************************
660 * %FUNCTION: radius_setmppekeys2
662 * vp -- value pair holding MS-MPPE-SEND-KEY or MS-MPPE-RECV-KEY attribute
663 * req_info -- radius request information used for encryption
665 * >= 0 on success; -1 on failure
667 * Decrypt the key provided by the RADIUS server for MPPE encryption.
669 ***********************************************************************/
671 radius_setmppekeys2(VALUE_PAIR *vp, REQUEST_INFO *req_info)
675 u_char *salt = vp->strvalue;
676 u_char *crypt = vp->strvalue + 2;
678 u_char buf[MD5_SIGNATURE_SIZE];
681 if (vp->attribute == PW_MS_MPPE_RECV_KEY)
684 if (vp->lvalue != 34) {
685 error("RADIUS: Incorrect attribute length (%d) for MS-MPPE-%s-Key",
690 if ((salt[0] & 0x80) == 0) {
691 error("RADIUS: Illegal salt value for MS-MPPE-%s-Key attribute", type);
695 memcpy(plain, crypt, 32);
698 MD5Update(&Context, req_info->secret, strlen(req_info->secret));
699 MD5Update(&Context, req_info->request_vector, AUTH_VECTOR_LEN);
700 MD5Update(&Context, salt, 2);
701 MD5Final(buf, &Context);
703 for (i = 0; i < 16; i++)
706 if (plain[0] != sizeof(mppe_send_key) /* 16 */) {
707 error("RADIUS: Incorrect key length (%d) for MS-MPPE-%s-Key attribute",
708 (int) plain[0], type);
713 MD5Update(&Context, req_info->secret, strlen(req_info->secret));
714 MD5Update(&Context, crypt, 16);
715 MD5Final(buf, &Context);
717 plain[16] ^= buf[0]; /* only need the first byte */
719 if (vp->attribute == PW_MS_MPPE_SEND_KEY)
720 memcpy(mppe_send_key, plain + 1, 16);
722 memcpy(mppe_recv_key, plain + 1, 16);
728 /**********************************************************************
729 * %FUNCTION: radius_acct_start
735 * Sends a "start" accounting message to the RADIUS server.
736 ***********************************************************************/
738 radius_acct_start(void)
742 VALUE_PAIR *send = NULL;
743 ipcp_options *ho = &ipcp_hisoptions[0];
746 if (!rstate.initialized) {
750 rstate.start_time = time(NULL);
752 strncpy(rstate.session_id, rc_mksid(), sizeof(rstate.session_id));
754 rc_avpair_add(&send, PW_ACCT_SESSION_ID,
755 rstate.session_id, 0, VENDOR_NONE);
756 rc_avpair_add(&send, PW_USER_NAME,
757 rstate.user, 0, VENDOR_NONE);
759 av_type = PW_STATUS_START;
760 rc_avpair_add(&send, PW_ACCT_STATUS_TYPE, &av_type, 0, VENDOR_NONE);
763 rc_avpair_add(&send, PW_SERVICE_TYPE, &av_type, 0, VENDOR_NONE);
766 rc_avpair_add(&send, PW_FRAMED_PROTOCOL, &av_type, 0, VENDOR_NONE);
768 if (*remote_number) {
769 rc_avpair_add(&send, PW_CALLING_STATION_ID,
770 remote_number, 0, VENDOR_NONE);
774 rc_avpair_add(&send, PW_ACCT_AUTHENTIC, &av_type, 0, VENDOR_NONE);
778 rc_avpair_add(&send, PW_NAS_PORT_TYPE, &av_type, 0, VENDOR_NONE);
780 hisaddr = ho->hisaddr;
781 av_type = htonl(hisaddr);
782 rc_avpair_add(&send, PW_FRAMED_IP_ADDRESS , &av_type , 0, VENDOR_NONE);
784 if (rstate.acctserver) {
785 result = rc_acct_using_server(rstate.acctserver,
786 rstate.client_port, send);
788 result = rc_acct(rstate.client_port, send);
791 rc_avpair_free(send);
793 if (result != OK_RC) {
794 /* RADIUS server could be down so make this a warning */
796 "Accounting START failed for %s", rstate.user);
798 rstate.accounting_started = 1;
799 /* Kick off periodic accounting reports */
800 if (rstate.acct_interim_interval) {
801 TIMEOUT(radius_acct_interim, NULL, rstate.acct_interim_interval);
806 /**********************************************************************
807 * %FUNCTION: radius_acct_stop
813 * Sends a "stop" accounting message to the RADIUS server.
814 ***********************************************************************/
816 radius_acct_stop(void)
819 VALUE_PAIR *send = NULL;
820 ipcp_options *ho = &ipcp_hisoptions[0];
824 if (!rstate.initialized) {
828 if (!rstate.accounting_started) {
832 rstate.accounting_started = 0;
833 rc_avpair_add(&send, PW_ACCT_SESSION_ID, rstate.session_id,
836 rc_avpair_add(&send, PW_USER_NAME, rstate.user, 0, VENDOR_NONE);
838 av_type = PW_STATUS_STOP;
839 rc_avpair_add(&send, PW_ACCT_STATUS_TYPE, &av_type, 0, VENDOR_NONE);
842 rc_avpair_add(&send, PW_SERVICE_TYPE, &av_type, 0, VENDOR_NONE);
845 rc_avpair_add(&send, PW_FRAMED_PROTOCOL, &av_type, 0, VENDOR_NONE);
848 rc_avpair_add(&send, PW_ACCT_AUTHENTIC, &av_type, 0, VENDOR_NONE);
851 if (link_stats_valid) {
852 av_type = link_connect_time;
853 rc_avpair_add(&send, PW_ACCT_SESSION_TIME, &av_type, 0, VENDOR_NONE);
855 av_type = link_stats.bytes_out;
856 rc_avpair_add(&send, PW_ACCT_OUTPUT_OCTETS, &av_type, 0, VENDOR_NONE);
858 av_type = link_stats.bytes_in;
859 rc_avpair_add(&send, PW_ACCT_INPUT_OCTETS, &av_type, 0, VENDOR_NONE);
861 av_type = link_stats.pkts_out;
862 rc_avpair_add(&send, PW_ACCT_OUTPUT_PACKETS, &av_type, 0, VENDOR_NONE);
864 av_type = link_stats.pkts_in;
865 rc_avpair_add(&send, PW_ACCT_INPUT_PACKETS, &av_type, 0, VENDOR_NONE);
868 if (*remote_number) {
869 rc_avpair_add(&send, PW_CALLING_STATION_ID,
870 remote_number, 0, VENDOR_NONE);
874 rc_avpair_add(&send, PW_NAS_PORT_TYPE, &av_type, 0, VENDOR_NONE);
876 hisaddr = ho->hisaddr;
877 av_type = htonl(hisaddr);
878 rc_avpair_add(&send, PW_FRAMED_IP_ADDRESS , &av_type , 0, VENDOR_NONE);
880 if (rstate.acctserver) {
881 result = rc_acct_using_server(rstate.acctserver,
882 rstate.client_port, send);
884 result = rc_acct(rstate.client_port, send);
887 if (result != OK_RC) {
888 /* RADIUS server could be down so make this a warning */
890 "Accounting STOP failed for %s", rstate.user);
892 rc_avpair_free(send);
895 /**********************************************************************
896 * %FUNCTION: radius_acct_interim
902 * Sends an interim accounting message to the RADIUS server
903 ***********************************************************************/
905 radius_acct_interim(void *ignored)
908 VALUE_PAIR *send = NULL;
909 ipcp_options *ho = &ipcp_hisoptions[0];
913 if (!rstate.initialized) {
917 if (!rstate.accounting_started) {
921 rc_avpair_add(&send, PW_ACCT_SESSION_ID, rstate.session_id,
924 rc_avpair_add(&send, PW_USER_NAME, rstate.user, 0, VENDOR_NONE);
926 av_type = PW_STATUS_ALIVE;
927 rc_avpair_add(&send, PW_ACCT_STATUS_TYPE, &av_type, 0, VENDOR_NONE);
930 rc_avpair_add(&send, PW_SERVICE_TYPE, &av_type, 0, VENDOR_NONE);
933 rc_avpair_add(&send, PW_FRAMED_PROTOCOL, &av_type, 0, VENDOR_NONE);
936 rc_avpair_add(&send, PW_ACCT_AUTHENTIC, &av_type, 0, VENDOR_NONE);
938 /* Update link stats */
939 update_link_stats(0);
941 if (link_stats_valid) {
942 link_stats_valid = 0; /* Force later code to update */
944 av_type = link_connect_time;
945 rc_avpair_add(&send, PW_ACCT_SESSION_TIME, &av_type, 0, VENDOR_NONE);
947 av_type = link_stats.bytes_out;
948 rc_avpair_add(&send, PW_ACCT_OUTPUT_OCTETS, &av_type, 0, VENDOR_NONE);
950 av_type = link_stats.bytes_in;
951 rc_avpair_add(&send, PW_ACCT_INPUT_OCTETS, &av_type, 0, VENDOR_NONE);
953 av_type = link_stats.pkts_out;
954 rc_avpair_add(&send, PW_ACCT_OUTPUT_PACKETS, &av_type, 0, VENDOR_NONE);
956 av_type = link_stats.pkts_in;
957 rc_avpair_add(&send, PW_ACCT_INPUT_PACKETS, &av_type, 0, VENDOR_NONE);
960 if (*remote_number) {
961 rc_avpair_add(&send, PW_CALLING_STATION_ID,
962 remote_number, 0, VENDOR_NONE);
966 rc_avpair_add(&send, PW_NAS_PORT_TYPE, &av_type, 0, VENDOR_NONE);
968 hisaddr = ho->hisaddr;
969 av_type = htonl(hisaddr);
970 rc_avpair_add(&send, PW_FRAMED_IP_ADDRESS , &av_type , 0, VENDOR_NONE);
972 if (rstate.acctserver) {
973 result = rc_acct_using_server(rstate.acctserver,
974 rstate.client_port, send);
976 result = rc_acct(rstate.client_port, send);
979 if (result != OK_RC) {
980 /* RADIUS server could be down so make this a warning */
982 "Interim accounting failed for %s", rstate.user);
984 rc_avpair_free(send);
986 /* Schedule another one */
987 TIMEOUT(radius_acct_interim, NULL, rstate.acct_interim_interval);
990 /**********************************************************************
991 * %FUNCTION: radius_ip_up
998 * Called when IPCP is up. We'll do a start-accounting record.
999 ***********************************************************************/
1001 radius_ip_up(void *opaque, int arg)
1003 radius_acct_start();
1006 /**********************************************************************
1007 * %FUNCTION: radius_ip_down
1014 * Called when IPCP is down. We'll do a stop-accounting record.
1015 ***********************************************************************/
1017 radius_ip_down(void *opaque, int arg)
1022 /**********************************************************************
1023 * %FUNCTION: radius_init
1025 * msg -- buffer of size BUF_LEN for error message
1027 * negative on failure; non-negative on success
1029 * Initializes radiusclient library
1030 ***********************************************************************/
1032 radius_init(char *msg)
1034 if (rstate.initialized) {
1038 if (config_file && *config_file) {
1039 strlcpy(rstate.config_file, config_file, MAXPATHLEN-1);
1042 rstate.initialized = 1;
1044 if (rc_read_config(rstate.config_file) != 0) {
1045 slprintf(msg, BUF_LEN, "RADIUS: Can't read config file %s",
1046 rstate.config_file);
1050 if (rc_read_dictionary(rc_conf_str("dictionary")) != 0) {
1051 slprintf(msg, BUF_LEN, "RADIUS: Can't read dictionary file %s",
1052 rc_conf_str("dictionary"));
1056 if (rc_read_mapfile(rc_conf_str("mapfile")) != 0) {
1057 slprintf(msg, BUF_LEN, "RADIUS: Can't read map file %s",
1058 rc_conf_str("mapfile"));
1064 /**********************************************************************
1065 * %FUNCTION: get_client_port
1067 * ifname -- PPP interface name (e.g. "ppp7")
1069 * The NAS port number (e.g. 7)
1071 * Extracts the port number from the interface name
1072 ***********************************************************************/
1074 get_client_port(char *ifname)
1077 if (sscanf(ifname, "ppp%d", &port) == 1) {
1080 return rc_map2id(ifname);
1083 /**********************************************************************
1084 * %FUNCTION: radius_allowed_address
1086 * addr -- IP address
1088 * 1 if we're allowed to use that IP address; 0 if not; -1 if we do
1090 ***********************************************************************/
1092 radius_allowed_address(u_int32_t addr)
1094 ipcp_options *wo = &ipcp_wantoptions[0];
1096 if (!rstate.choose_ip) {
1097 /* If RADIUS server said any address is OK, then fine... */
1098 if (rstate.any_ip_addr_ok) {
1102 /* Sigh... if an address was supplied for remote host in pppd
1103 options, it has to match that. */
1104 if (wo->hisaddr != 0 && wo->hisaddr == addr) {
1110 if (addr == rstate.ip_addr) return 1;
1114 /* Useful for other plugins */
1115 char *radius_logged_in_user(void)