From: yasuoka Date: Sun, 24 Mar 2024 00:05:01 +0000 (+0000) Subject: Allow zero-length identity response X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=142156d01f6c54c4919a16c97892628ff7f95ed7;p=openbsd Allow zero-length identity response ok tobhe --- diff --git a/sbin/iked/eap.c b/sbin/iked/eap.c index 137398d91f4..40cbe627da0 100644 --- a/sbin/iked/eap.c +++ b/sbin/iked/eap.c @@ -1,4 +1,4 @@ -/* $OpenBSD: eap.c,v 1.25 2023/07/18 15:07:41 claudio Exp $ */ +/* $OpenBSD: eap.c,v 1.26 2024/03/24 00:05:01 yasuoka Exp $ */ /* * Copyright (c) 2010-2013 Reyk Floeter @@ -71,7 +71,12 @@ eap_validate_id_response(struct eap_message *eap) len = betoh16(eap->eap_length) - sizeof(*eap); ptr += sizeof(*eap); - if (len == 0 || (str = get_string(ptr, len)) == NULL) { + if (len == 0) { + if ((str = strdup("")) == NULL) { + log_warn("%s: strdup failed", __func__); + return (NULL); + } + } else if ((str = get_string(ptr, len)) == NULL) { log_info("%s: invalid identity response, length %zu", __func__, len); return (NULL); diff --git a/sbin/iked/radius.c b/sbin/iked/radius.c new file mode 100644 index 00000000000..1614093fa38 --- /dev/null +++ b/sbin/iked/radius.c @@ -0,0 +1,752 @@ +/* $OpenBSD: radius.c,v 1.1 2024/03/24 00:05:01 yasuoka Exp $ */ + +/* + * Copyright (c) 2024 Internet Initiative Japan Inc. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "iked.h" +#include "eap.h" +#include "ikev2.h" +#include "types.h" + +void iked_radius_request_send(struct iked *, void *); +void iked_radius_config(struct iked_radserver_req *, const RADIUS_PACKET *, + int, uint32_t, uint8_t); +void iked_radius_acct_request(struct iked *, struct iked_sa *, uint8_t); + +const struct iked_radcfgmap radius_cfgmaps[] = { + { IKEV2_CFG_INTERNAL_IP4_ADDRESS, 0, RADIUS_TYPE_FRAMED_IP_ADDRESS }, + { IKEV2_CFG_INTERNAL_IP4_NETMASK, 0, RADIUS_TYPE_FRAMED_IP_NETMASK }, + { IKEV2_CFG_INTERNAL_IP4_DNS, RADIUS_VENDOR_MICROSOFT, + RADIUS_VTYPE_MS_PRIMARY_DNS_SERVER }, + { IKEV2_CFG_INTERNAL_IP4_DNS, RADIUS_VENDOR_MICROSOFT, + RADIUS_VTYPE_MS_SECONDARY_DNS_SERVER }, + { IKEV2_CFG_INTERNAL_IP4_NBNS, RADIUS_VENDOR_MICROSOFT, + RADIUS_VTYPE_MS_PRIMARY_NBNS_SERVER }, + { IKEV2_CFG_INTERNAL_IP4_NBNS, RADIUS_VENDOR_MICROSOFT, + RADIUS_VTYPE_MS_SECONDARY_NBNS_SERVER }, + { 0 } +}; + +int +iked_radius_request(struct iked *env, struct iked_sa *sa, + struct iked_message *msg) +{ + struct eap_message *eap; + RADIUS_PACKET *pkt; + size_t len; + + eap = ibuf_data(msg->msg_eapmsg); + len = betoh16(eap->eap_length); + if (eap->eap_code != EAP_CODE_RESPONSE) { + log_debug("%s: eap_code is not response %u", __func__, + (unsigned)eap->eap_code); + return -1; + } + + if (eap->eap_type == EAP_TYPE_IDENTITY) { + if ((sa->sa_radreq = calloc(1, + sizeof(struct iked_radserver_req))) == NULL) { + log_debug( + "%s: calloc failed for iked_radserver_req: %s", + __func__, strerror(errno)); + return (-1); + } + timer_set(env, &sa->sa_radreq->rr_timer, + iked_radius_request_send, sa->sa_radreq); + sa->sa_radreq->rr_user = strdup(msg->msg_eap.eam_identity); + } + + if ((pkt = radius_new_request_packet(RADIUS_CODE_ACCESS_REQUEST)) + == NULL) { + log_debug("%s: radius_new_request_packet failed %s", __func__, + strerror(errno)); + return -1; + } + + radius_put_string_attr(pkt, RADIUS_TYPE_USER_NAME, + sa->sa_radreq->rr_user); + if (sa->sa_radreq->rr_state != NULL) + radius_put_raw_attr(pkt, RADIUS_TYPE_STATE, + ibuf_data(sa->sa_radreq->rr_state), + ibuf_size(sa->sa_radreq->rr_state)); + + if (radius_put_raw_attr_cat(pkt, RADIUS_TYPE_EAP_MESSAGE, + (uint8_t *)eap, len) == -1) { + log_debug("%s: radius_put_raw_attr_cat failed %s", __func__, + strerror(errno)); + return -1; + } + + /* save the request, it'll be needed for message authentication */ + if (sa->sa_radreq->rr_reqpkt != NULL) + radius_delete_packet(sa->sa_radreq->rr_reqpkt); + sa->sa_radreq->rr_reqpkt = pkt; + sa->sa_radreq->rr_sa = sa; + sa->sa_radreq->rr_ntry = 0; + + iked_radius_request_send(env, sa->sa_radreq); + + return 0; +} + +void +iked_radius_request_free(struct iked *env, struct iked_radserver_req *req) +{ + if (req == NULL) + return; + timer_del(env, &req->rr_timer); + free(req->rr_user); + ibuf_free(req->rr_state); + if (req->rr_reqpkt) + radius_delete_packet(req->rr_reqpkt); + if (req->rr_sa) + req->rr_sa->sa_radreq = NULL; + if (req->rr_server) + TAILQ_REMOVE(&req->rr_server->rs_reqs, req, rr_entry); + free(req); +} + +void +iked_radius_on_event(int fd, short ev, void *ctx) +{ + struct iked *env; + struct iked_radserver *server = ctx; + struct iked_radserver_req *req; + const struct iked_radcfgmap *cfgmap; + RADIUS_PACKET *pkt; + int i, resid; + struct ibuf *e; + const void *attrval; + size_t attrlen; + uint8_t code; + u_char eapmsk[128]; + /* RFC 3748 defines the MSK minimum size is 64 bytes */ + size_t eapmsksiz = sizeof(eapmsk); + + env = server->rs_env; + pkt = radius_recv(server->rs_sock, 0); + if (pkt == NULL) { + log_info("%s: receiving a RADIUS message failed: %s", __func__, + strerror(errno)); + return; + } + resid = radius_get_id(pkt); + + TAILQ_FOREACH(req, &server->rs_reqs, rr_entry) { + if (req->rr_reqid == resid) + break; + } + if (req == NULL) { + log_debug("%s: received an unknown RADIUS message: id=%u", + __func__, (unsigned)resid); + return; + } + + radius_set_request_packet(pkt, req->rr_reqpkt); + if (radius_check_response_authenticator(pkt, server->rs_secret) != 0) { + log_info("%s: received an invalid RADIUS message: bad " + "response authenticator", __func__); + return; + } + if (req->rr_accounting) { + /* accounting */ + code = radius_get_code(pkt); + switch (code) { + case RADIUS_CODE_ACCOUNTING_RESPONSE: /* Expected */ + break; + default: + log_info("%s: received an invalid RADIUS message: " + "code %u", __func__, (unsigned)code); + } + timer_del(env, &req->rr_timer); + TAILQ_REMOVE(&server->rs_reqs, req, rr_entry); + req->rr_server = NULL; + free(req); + return; + } + + /* authentication */ + if (radius_check_message_authenticator(pkt, server->rs_secret) != 0) { + log_info("%s: received an invalid RADIUS message: bad " + "message authenticator", __func__); + return; + } + + timer_del(env, &req->rr_timer); + req->rr_ntry = 0; + + if (req->rr_sa == NULL) + goto fail; + + code = radius_get_code(pkt); + switch (code) { + case RADIUS_CODE_ACCESS_CHALLENGE: + if (radius_get_raw_attr_ptr(pkt, RADIUS_TYPE_STATE, &attrval, + &attrlen) != 0) { + log_info("%s: received an invalid RADIUS message: no " + "state attribute", __func__); + goto fail; + } + if ((req->rr_state != NULL && + ibuf_set(req->rr_state, 0, attrval, attrlen) != 0) || + (req->rr_state = ibuf_new(attrval, attrlen)) == NULL) { + log_info("%s: ibuf_new() failed: %s", __func__, + strerror(errno)); + goto fail; + } + break; + case RADIUS_CODE_ACCESS_ACCEPT: + log_info("%s: received Access-Accept for %s", + SPI_SA(req->rr_sa, __func__), req->rr_user); + /* Try to retrieve the EAP MSK from the RADIUS response */ + if (radius_get_eap_msk(pkt, eapmsk, &eapmsksiz, + server->rs_secret) == 0) { + ibuf_free(req->rr_sa->sa_eapmsk); + if ((req->rr_sa->sa_eapmsk = ibuf_new(eapmsk, + eapmsksiz)) == NULL) { + log_info("%s: ibuf_new() failed: %s", __func__, + strerror(errno)); + goto fail; + } + } else + log_debug("Could not retrieve the EAP MSK from the " + "RADIUS message"); + free(req->rr_sa->sa_eapid); + req->rr_sa->sa_eapid = req->rr_user; + req->rr_user = NULL; + sa_state(env, req->rr_sa, IKEV2_STATE_AUTH_SUCCESS); + + /* Map RADIUS attributes to cp */ + if (TAILQ_EMPTY(&env->sc_radcfgmaps)) { + for (i = 0; radius_cfgmaps[i].cfg_type != 0; i++) { + cfgmap = &radius_cfgmaps[i]; + iked_radius_config(req, pkt, cfgmap->cfg_type, + cfgmap->vendor_id, cfgmap->attr_type); + } + } else { + TAILQ_FOREACH(cfgmap, &env->sc_radcfgmaps, entry) + iked_radius_config(req, pkt, cfgmap->cfg_type, + cfgmap->vendor_id, cfgmap->attr_type); + } + + TAILQ_REMOVE(&server->rs_reqs, req, rr_entry); + req->rr_server = NULL; + break; + case RADIUS_CODE_ACCESS_REJECT: + log_info("%s: received Access-Reject for %s", + SPI_SA(req->rr_sa, __func__), req->rr_user); + TAILQ_REMOVE(&server->rs_reqs, req, rr_entry); + req->rr_server = NULL; + break; + default: + log_debug("%s: received an invalid RADIUS message: code %u", + __func__, (unsigned)code); + break; + } + + /* get the length first */ + if (radius_get_raw_attr_cat(pkt, RADIUS_TYPE_EAP_MESSAGE, NULL, + &attrlen) != 0) { + log_info("%s: failed to retrieve the EAP message", __func__); + goto fail; + } + /* allocate a buffer */ + if ((e = ibuf_new(NULL, attrlen)) == NULL) { + log_info("%s: ibuf_new() failed: %s", __func__, + strerror(errno)); + goto fail; + } + /* copy the message to the buffer */ + if (radius_get_raw_attr_cat(pkt, RADIUS_TYPE_EAP_MESSAGE, + ibuf_data(e), &attrlen) != 0) { + ibuf_free(e); + log_info("%s: failed to retrieve the EAP message", __func__); + goto fail; + } + ikev2_send_ike_e(env, req->rr_sa, e, IKEV2_PAYLOAD_EAP, + IKEV2_EXCHANGE_IKE_AUTH, 1); + return; + fail: + if (req->rr_server != NULL) + TAILQ_REMOVE(&server->rs_reqs, req, rr_entry); + req->rr_server = NULL; + if (req->rr_sa != NULL) { + ikev2_ike_sa_setreason(req->rr_sa, "RADIUS request failed"); + sa_free(env, req->rr_sa); + } +} + +void +iked_radius_request_send(struct iked *env, void *ctx) +{ + struct iked_radserver_req *req = ctx, *req0; + struct iked_radserver *server = req->rr_server; + const int timeouts[] = { 2, 4, 8 }; + uint8_t seq; + int i, max_tries, max_failovers; + struct sockaddr_storage ss; + socklen_t sslen; + struct iked_radservers *radservers; + struct timespec now; + + if (!req->rr_accounting) { + max_tries = env->sc_radauth.max_tries; + max_failovers = env->sc_radauth.max_failovers; + radservers = &env->sc_radauthservers; + } else { + max_tries = env->sc_radacct.max_tries; + max_failovers = env->sc_radacct.max_failovers; + radservers = &env->sc_radacctservers; + } + + if (req->rr_ntry > max_tries) { + req->rr_ntry = 0; + log_info("%s: RADIUS server %s failed", __func__, + print_addr(&server->rs_sockaddr)); + next_server: + TAILQ_REMOVE(&server->rs_reqs, req, rr_entry); + req->rr_server = NULL; + if (req->rr_nfailover >= max_failovers || + TAILQ_NEXT(server, rs_entry) == NULL) { + log_info("%s: No more RADIUS server", __func__); + goto fail; + } else if (req->rr_state != NULL) { + log_info("%s: Can't change RADIUS server: " + "client has a state already", __func__); + goto fail; + } else { + TAILQ_REMOVE(radservers, server, rs_entry); + TAILQ_INSERT_TAIL(radservers, server, rs_entry); + server = TAILQ_FIRST(radservers); + log_info("%s: RADIUS server %s is active", + __func__, print_addr(&server->rs_sockaddr)); + } + req->rr_nfailover++; + } + + if (req->rr_server != NULL && + req->rr_server != TAILQ_FIRST(radservers)) { + /* Current server is marked fail */ + if (req->rr_state != NULL || req->rr_nfailover >= max_failovers) + goto fail; /* can't fail over */ + TAILQ_REMOVE(&server->rs_reqs, req, rr_entry); + req->rr_server = NULL; + req->rr_nfailover++; + } + + if (req->rr_server == NULL) { + /* Select a new server */ + server = TAILQ_FIRST(radservers); + if (server == NULL) { + log_info("%s: No RADIUS server is configured", + __func__); + goto fail; + } + TAILQ_INSERT_TAIL(&server->rs_reqs, req, rr_entry); + req->rr_server = server; + + /* Prepare NAS-IP-Address */ + if (server->rs_nas_ipv4.s_addr == INADDR_ANY && + IN6_IS_ADDR_UNSPECIFIED(&server->rs_nas_ipv6)) { + sslen = sizeof(ss); + if (getsockname(server->rs_sock, (struct sockaddr *)&ss, + &sslen) == 0) { + if (ss.ss_family == AF_INET) + server->rs_nas_ipv4 = + ((struct sockaddr_in *)&ss) + ->sin_addr; + else + server->rs_nas_ipv6 = + ((struct sockaddr_in6 *)&ss) + ->sin6_addr; + } + } + } + if (req->rr_ntry == 0) { + /* decide the ID */ + seq = ++server->rs_reqseq; + for (i = 0; i < UCHAR_MAX; i++) { + TAILQ_FOREACH(req0, &server->rs_reqs, rr_entry) { + if (req0->rr_reqid == seq) + break; + } + if (req0 == NULL) + break; + seq++; + } + if (i >= UCHAR_MAX) { + log_info("%s: RADIUS server %s failed. Too many " + "pending requests", __func__, + print_addr(&server->rs_sockaddr)); + if (TAILQ_NEXT(server, rs_entry) != NULL) + goto next_server; + goto fail; + } + req->rr_reqid = seq; + radius_set_id(req->rr_reqpkt, req->rr_reqid); + } + + if (server->rs_nas_ipv4.s_addr != INADDR_ANY) + radius_put_ipv4_attr(req->rr_reqpkt, RADIUS_TYPE_NAS_IP_ADDRESS, + server->rs_nas_ipv4); + else if (!IN6_IS_ADDR_UNSPECIFIED(&server->rs_nas_ipv6)) + radius_put_ipv6_attr(req->rr_reqpkt, + RADIUS_TYPE_NAS_IPV6_ADDRESS, &server->rs_nas_ipv6); + /* Identifier */ + radius_put_string_attr(req->rr_reqpkt, RADIUS_TYPE_NAS_IDENTIFIER, + "OpenIKED"); + + /* NAS Port Type = Virtual */ + radius_put_uint32_attr(req->rr_reqpkt, + RADIUS_TYPE_NAS_PORT_TYPE, RADIUS_NAS_PORT_TYPE_VIRTUAL); + /* Service Type = Framed */ + radius_put_uint32_attr(req->rr_reqpkt, + RADIUS_TYPE_SERVICE_TYPE, RADIUS_SERVICE_TYPE_FRAMED); + + if (req->rr_accounting) { + if (req->rr_ntry == 0 && req->rr_nfailover == 0) + radius_put_uint32_attr(req->rr_reqpkt, + RADIUS_TYPE_ACCT_DELAY_TIME, 0); + else { + clock_gettime(CLOCK_MONOTONIC, &now); + timespecsub(&now, &req->rr_accttime, &now); + radius_put_uint32_attr(req->rr_reqpkt, + RADIUS_TYPE_ACCT_DELAY_TIME, now.tv_sec); + } + radius_set_accounting_request_authenticator(req->rr_reqpkt, + server->rs_secret); + } else { + radius_put_message_authenticator(req->rr_reqpkt, + server->rs_secret); + } + + if (radius_send(server->rs_sock, req->rr_reqpkt, 0) < 0) + log_info("%s: sending a RADIUS message failed: %s", __func__, + strerror(errno)); + + if (req->rr_ntry >= (int)nitems(timeouts)) + timer_add(env, &req->rr_timer, timeouts[nitems(timeouts) - 1]); + else + timer_add(env, &req->rr_timer, timeouts[req->rr_ntry]); + req->rr_ntry++; + return; + fail: + if (req->rr_server != NULL) + TAILQ_REMOVE(&server->rs_reqs, req, rr_entry); + req->rr_server = NULL; + if (req->rr_sa != NULL) { + ikev2_ike_sa_setreason(req->rr_sa, "RADIUS request failed"); + sa_free(env, req->rr_sa); + } +} + +void +iked_radius_config(struct iked_radserver_req *req, const RADIUS_PACKET *pkt, + int cfg_type, uint32_t vendor_id, uint8_t attr_type) +{ + unsigned int i; + struct iked_sa *sa = req->rr_sa; + struct in_addr ia4; + struct in6_addr ia6; + struct sockaddr_in *sin4; + struct sockaddr_in6 *sin6; + struct iked_addr *addr; + struct iked_cfg *ikecfg; + + for (i = 0; i < sa->sa_policy->pol_ncfg; i++) { + ikecfg = &sa->sa_policy->pol_cfg[i]; + if (ikecfg->cfg_type == cfg_type && + ikecfg->cfg_type != IKEV2_CFG_INTERNAL_IP4_ADDRESS) + return; /* use config rather than radius */ + } + switch (cfg_type) { + case IKEV2_CFG_INTERNAL_IP4_ADDRESS: + case IKEV2_CFG_INTERNAL_IP4_NETMASK: + case IKEV2_CFG_INTERNAL_IP4_DNS: + case IKEV2_CFG_INTERNAL_IP4_NBNS: + case IKEV2_CFG_INTERNAL_IP4_DHCP: + case IKEV2_CFG_INTERNAL_IP4_SERVER: + if (vendor_id == 0 && radius_has_attr(pkt, attr_type)) + radius_get_ipv4_attr(pkt, attr_type, &ia4); + else if (vendor_id != 0 && radius_has_vs_attr(pkt, vendor_id, + attr_type)) + radius_get_vs_ipv4_attr(pkt, vendor_id, attr_type, + &ia4); + else + break; /* no attribute contained */ + + if (cfg_type == IKEV2_CFG_INTERNAL_IP4_NETMASK) { + /* + * This assumes IKEV2_CFG_INTERNAL_IP4_ADDRESS is + * called before IKEV2_CFG_INTERNAL_IP4_NETMASK + */ + if (sa->sa_rad_addr == NULL) { + /* + * RFC 7296, IKEV2_CFG_INTERNAL_IP4_NETMASK + * must be used with + * IKEV2_CFG_INTERNAL_IP4_ADDRESS + */ + break; + } + if (ia4.s_addr == 0) { + log_debug("%s: netmask is wrong", __func__); + break; + } + if (ia4.s_addr == htonl(0)) + sa->sa_rad_addr->addr_mask = 0; + else + sa->sa_rad_addr->addr_mask = + 33 - ffs(ntohl(ia4.s_addr)); + if (sa->sa_rad_addr->addr_mask < 32) + sa->sa_rad_addr->addr_net = 1; + } + if (cfg_type == IKEV2_CFG_INTERNAL_IP4_ADDRESS) { + if ((addr = calloc(1, sizeof(*addr))) == NULL) { + log_warn("%s: calloc", __func__); + return; + } + sa->sa_rad_addr = addr; + } else { + req->rr_cfg[req->rr_ncfg].cfg_action = IKEV2_CP_REPLY; + req->rr_cfg[req->rr_ncfg].cfg_type = cfg_type; + addr = &req->rr_cfg[req->rr_ncfg].cfg.address; + req->rr_ncfg++; + } + addr->addr_af = AF_INET; + sin4 = (struct sockaddr_in *)&addr->addr; + sin4->sin_family = AF_INET; + sin4->sin_len = sizeof(struct sockaddr_in); + sin4->sin_addr = ia4; + break; + case IKEV2_CFG_INTERNAL_IP6_ADDRESS: + case IKEV2_CFG_INTERNAL_IP6_DNS: + case IKEV2_CFG_INTERNAL_IP6_NBNS: + case IKEV2_CFG_INTERNAL_IP6_DHCP: + case IKEV2_CFG_INTERNAL_IP6_SERVER: + if (vendor_id == 0 && radius_has_attr(pkt, attr_type)) + radius_get_ipv6_attr(pkt, attr_type, &ia6); + else if (vendor_id != 0 && radius_has_vs_attr(pkt, vendor_id, + attr_type)) + radius_get_vs_ipv6_attr(pkt, vendor_id, attr_type, + &ia6); + else + break; /* no attribute contained */ + + if (cfg_type == IKEV2_CFG_INTERNAL_IP6_ADDRESS) { + if ((addr = calloc(1, sizeof(*addr))) == NULL) { + log_warn("%s: calloc", __func__); + return; + } + sa->sa_rad_addr = addr; + } else { + req->rr_cfg[req->rr_ncfg].cfg_action = IKEV2_CP_REPLY; + req->rr_cfg[req->rr_ncfg].cfg_type = cfg_type; + addr = &req->rr_cfg[req->rr_ncfg].cfg.address; + req->rr_ncfg++; + } + addr->addr_af = AF_INET; + sin6 = (struct sockaddr_in6 *)&addr->addr; + sin6->sin6_family = AF_INET6; + sin6->sin6_len = sizeof(struct sockaddr_in6); + sin6->sin6_addr = ia6; + break; + } + return; +} + +void +iked_radius_acct_on(struct iked *env) +{ + if (TAILQ_EMPTY(&env->sc_radacctservers)) + return; + if (env->sc_radaccton == 0) { /* trigger once */ + iked_radius_acct_request(env, NULL, RADIUS_ACCT_STATUS_TYPE_ACCT_ON); + env->sc_radaccton = 1; + } +} + +void +iked_radius_acct_off(struct iked *env) +{ + iked_radius_acct_request(env, NULL, RADIUS_ACCT_STATUS_TYPE_ACCT_OFF); +} + +void +iked_radius_acct_start(struct iked *env, struct iked_sa *sa) +{ + iked_radius_acct_request(env, sa, RADIUS_ACCT_STATUS_TYPE_START); +} + +void +iked_radius_acct_stop(struct iked *env, struct iked_sa *sa) +{ + iked_radius_acct_request(env, sa, RADIUS_ACCT_STATUS_TYPE_STOP); +} + +void +iked_radius_acct_request(struct iked *env, struct iked_sa *sa, uint8_t stype) +{ + struct iked_radserver_req *req; + RADIUS_PACKET *pkt; + struct iked_addr *addr4 = NULL; + struct iked_addr *addr6 = NULL; + struct in_addr mask4; + char sa_id[IKED_ID_SIZE]; + char sid[16 + 1]; + struct timespec now; + int cause; + + if (TAILQ_EMPTY(&env->sc_radacctservers)) + return; + /* + * In RFC2866 5.6, "Users who are delivered service without + * being authenticated SHOULD NOT generate Accounting records + */ + if (sa != NULL && sa->sa_eapid == NULL) { + /* fallback to IKEID for accounting */ + if (ikev2_print_id(IKESA_DSTID(sa), sa_id, sizeof(sa_id)) != -1) + sa->sa_eapid = strdup(sa_id); + if (sa->sa_eapid == NULL) + return; + } + + if ((req = calloc(1, sizeof(struct iked_radserver_req))) == NULL) { + log_debug("%s: calloc faile for iked_radserver_req: %s", + __func__, strerror(errno)); + return; + } + req->rr_accounting = 1; + clock_gettime(CLOCK_MONOTONIC, &now); + req->rr_accttime = now; + timer_set(env, &req->rr_timer, iked_radius_request_send, req); + + if ((pkt = radius_new_request_packet(RADIUS_CODE_ACCOUNTING_REQUEST)) + == NULL) { + log_debug("%s: radius_new_request_packet failed %s", __func__, + strerror(errno)); + return; + } + + /* RFC 2866 5.1. Acct-Status-Type */ + radius_put_uint32_attr(pkt, RADIUS_TYPE_ACCT_STATUS_TYPE, stype); + + if (sa == NULL) { + /* ASSERT(stype == RADIUS_ACCT_STATUS_TYPE_ACCT_ON || + stype == RADIUS_ACCT_STATUS_TYPE_ACCT_OFF) */ + req->rr_reqpkt = pkt; + req->rr_ntry = 0; + iked_radius_request_send(env, req); + return; + } + + radius_put_string_attr(pkt, RADIUS_TYPE_USER_NAME, sa->sa_eapid); + + /* RFC 2866 5.5. Acct-Session-Id */ + snprintf(sid, sizeof(sid), "%016llx", + (unsigned long long)sa->sa_hdr.sh_ispi); + radius_put_string_attr(pkt, RADIUS_TYPE_ACCT_SESSION_ID, sid); + + /* Accounting Request must have Framed-IP-Address */ + addr4 = sa->sa_addrpool; + if (addr4 != NULL) { + radius_put_ipv4_attr(pkt, RADIUS_TYPE_FRAMED_IP_ADDRESS, + ((struct sockaddr_in *)&addr4->addr)->sin_addr); + if (addr4->addr_mask != 0) { + mask4.s_addr = htonl( + 0xFFFFFFFFUL << (32 - addr4->addr_mask)); + radius_put_ipv4_attr(pkt, + RADIUS_TYPE_FRAMED_IP_NETMASK, mask4); + } + } + addr6 = sa->sa_addrpool6; + if (addr6 != NULL) + radius_put_ipv6_attr(pkt, RADIUS_TYPE_FRAMED_IPV6_ADDRESS, + &((struct sockaddr_in6 *)&addr6->addr)->sin6_addr); + + /* RFC2866 5.6 Acct-Authentic */ + radius_put_uint32_attr(pkt, RADIUS_TYPE_ACCT_AUTHENTIC, + (sa->sa_radreq != NULL)? RADIUS_ACCT_AUTHENTIC_RADIUS : + RADIUS_ACCT_AUTHENTIC_LOCAL); + + switch (stype) { + case RADIUS_ACCT_STATUS_TYPE_START: + radius_put_uint32_attr(pkt, RADIUS_TYPE_ACCT_STATUS_TYPE, + RADIUS_ACCT_STATUS_TYPE_START); + break; + case RADIUS_ACCT_STATUS_TYPE_INTERIM_UPDATE: + case RADIUS_ACCT_STATUS_TYPE_STOP: + /* RFC 2866 5.7. Acct-Session-Time */ + timespecsub(&now, &sa->sa_starttime, &now); + radius_put_uint32_attr(pkt, RADIUS_TYPE_ACCT_SESSION_TIME, + now.tv_sec); + /* RFC 2866 5.10 Acct-Terminate-Cause */ + cause = RADIUS_TERMNATE_CAUSE_SERVICE_UNAVAIL; + if (sa->sa_reason) { + if (strcmp(sa->sa_reason, "received delete") == 0) { + cause = RADIUS_TERMNATE_CAUSE_USER_REQUEST; + } else if (strcmp(sa->sa_reason, "SA rekeyed") == 0) { + cause = RADIUS_TERMNATE_CAUSE_SESSION_TIMEOUT; + } else if (strncmp(sa->sa_reason, "retransmit", + strlen("retransmit")) == 0) { + cause = RADIUS_TERMNATE_CAUSE_LOST_SERVICE; + } + } + radius_put_uint32_attr(pkt, RADIUS_TYPE_ACCT_TERMINATE_CAUSE, + cause); + /* I/O statistics {Input,Output}-{Packets,Octets,Gigawords} */ + radius_put_uint32_attr(pkt, RADIUS_TYPE_ACCT_INPUT_PACKETS, + sa->sa_stats.sas_ipackets); + radius_put_uint32_attr(pkt, RADIUS_TYPE_ACCT_OUTPUT_PACKETS, + sa->sa_stats.sas_opackets); + radius_put_uint32_attr(pkt, RADIUS_TYPE_ACCT_INPUT_OCTETS, + sa->sa_stats.sas_ibytes & 0xffffffffUL); + radius_put_uint32_attr(pkt, RADIUS_TYPE_ACCT_OUTPUT_OCTETS, + sa->sa_stats.sas_obytes & 0xffffffffUL); + radius_put_uint32_attr(pkt, RADIUS_TYPE_ACCT_INPUT_GIGAWORDS, + sa->sa_stats.sas_ibytes >> 32); + radius_put_uint32_attr(pkt, RADIUS_TYPE_ACCT_OUTPUT_GIGAWORDS, + sa->sa_stats.sas_obytes >> 32); + radius_put_string_attr(pkt, RADIUS_TYPE_CALLED_STATION_ID, + print_addr(&sa->sa_local.addr)); + radius_put_string_attr(pkt, RADIUS_TYPE_CALLING_STATION_ID, + print_addr(&sa->sa_peer.addr)); + break; + } + req->rr_reqpkt = pkt; + req->rr_ntry = 0; + iked_radius_request_send(env, req); +}