blob: 7c55146b2c5c2780d2e1e2d4f0b23c5d72bd258c [file] [log] [blame]
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001/*
2 * hostapd / RADIUS Accounting
Dmitry Shmidt04949592012-07-19 12:16:46 -07003 * Copyright (c) 2002-2009, 2012, Jouni Malinen <j@w1.fi>
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07004 *
Dmitry Shmidtc5ec7f52012-03-06 16:33:24 -08005 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07007 */
8
9#include "utils/includes.h"
10
11#include "utils/common.h"
12#include "utils/eloop.h"
Dmitry Shmidtfb45fd52015-01-05 13:08:17 -080013#include "eapol_auth/eapol_auth_sm.h"
14#include "eapol_auth/eapol_auth_sm_i.h"
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070015#include "radius/radius.h"
16#include "radius/radius_client.h"
17#include "hostapd.h"
18#include "ieee802_1x.h"
19#include "ap_config.h"
20#include "sta_info.h"
21#include "ap_drv_ops.h"
22#include "accounting.h"
23
24
25/* Default interval in seconds for polling TX/RX octets from the driver if
26 * STA is not using interim accounting. This detects wrap arounds for
27 * input/output octets and updates Acct-{Input,Output}-Gigawords. */
28#define ACCT_DEFAULT_UPDATE_INTERVAL 300
29
Dmitry Shmidt61d9df32012-08-29 16:22:06 -070030static void accounting_sta_interim(struct hostapd_data *hapd,
31 struct sta_info *sta);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070032
33
34static struct radius_msg * accounting_msg(struct hostapd_data *hapd,
35 struct sta_info *sta,
36 int status_type)
37{
38 struct radius_msg *msg;
39 char buf[128];
40 u8 *val;
41 size_t len;
42 int i;
Dmitry Shmidt04949592012-07-19 12:16:46 -070043 struct wpabuf *b;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070044
45 msg = radius_msg_new(RADIUS_CODE_ACCOUNTING_REQUEST,
46 radius_client_get_id(hapd->radius));
47 if (msg == NULL) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -080048 wpa_printf(MSG_INFO, "Could not create new RADIUS packet");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070049 return NULL;
50 }
51
52 if (sta) {
53 radius_msg_make_authenticator(msg, (u8 *) sta, sizeof(*sta));
54
Dmitry Shmidtfb45fd52015-01-05 13:08:17 -080055 if ((hapd->conf->wpa & 2) &&
56 !hapd->conf->disable_pmksa_caching &&
57 sta->eapol_sm && sta->eapol_sm->acct_multi_session_id_hi) {
58 os_snprintf(buf, sizeof(buf), "%08X+%08X",
59 sta->eapol_sm->acct_multi_session_id_hi,
60 sta->eapol_sm->acct_multi_session_id_lo);
61 if (!radius_msg_add_attr(
62 msg, RADIUS_ATTR_ACCT_MULTI_SESSION_ID,
63 (u8 *) buf, os_strlen(buf))) {
64 wpa_printf(MSG_INFO,
65 "Could not add Acct-Multi-Session-Id");
66 goto fail;
67 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070068 }
69 } else {
70 radius_msg_make_authenticator(msg, (u8 *) hapd, sizeof(*hapd));
71 }
72
73 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_STATUS_TYPE,
74 status_type)) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -080075 wpa_printf(MSG_INFO, "Could not add Acct-Status-Type");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070076 goto fail;
77 }
78
Dmitry Shmidt04949592012-07-19 12:16:46 -070079 if (!hostapd_config_get_radius_attr(hapd->conf->radius_acct_req_attr,
80 RADIUS_ATTR_ACCT_AUTHENTIC) &&
81 !radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_AUTHENTIC,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070082 hapd->conf->ieee802_1x ?
83 RADIUS_ACCT_AUTHENTIC_RADIUS :
84 RADIUS_ACCT_AUTHENTIC_LOCAL)) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -080085 wpa_printf(MSG_INFO, "Could not add Acct-Authentic");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070086 goto fail;
87 }
88
89 if (sta) {
Dmitry Shmidt61d9df32012-08-29 16:22:06 -070090 /* Use 802.1X identity if available */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070091 val = ieee802_1x_get_identity(sta->eapol_sm, &len);
Dmitry Shmidt61d9df32012-08-29 16:22:06 -070092
93 /* Use RADIUS ACL identity if 802.1X provides no identity */
94 if (!val && sta->identity) {
95 val = (u8 *) sta->identity;
96 len = os_strlen(sta->identity);
97 }
98
99 /* Use STA MAC if neither 802.1X nor RADIUS ACL provided
100 * identity */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700101 if (!val) {
102 os_snprintf(buf, sizeof(buf), RADIUS_ADDR_FORMAT,
103 MAC2STR(sta->addr));
104 val = (u8 *) buf;
105 len = os_strlen(buf);
106 }
107
108 if (!radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME, val,
109 len)) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -0800110 wpa_printf(MSG_INFO, "Could not add User-Name");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700111 goto fail;
112 }
113 }
114
Dmitry Shmidt61d9df32012-08-29 16:22:06 -0700115 if (add_common_radius_attr(hapd, hapd->conf->radius_acct_req_attr, sta,
116 msg) < 0)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700117 goto fail;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700118
119 if (sta) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700120 for (i = 0; ; i++) {
121 val = ieee802_1x_get_radius_class(sta->eapol_sm, &len,
122 i);
123 if (val == NULL)
124 break;
125
126 if (!radius_msg_add_attr(msg, RADIUS_ATTR_CLASS,
127 val, len)) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -0800128 wpa_printf(MSG_INFO, "Could not add Class");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700129 goto fail;
130 }
131 }
Dmitry Shmidt04949592012-07-19 12:16:46 -0700132
133 b = ieee802_1x_get_radius_cui(sta->eapol_sm);
134 if (b &&
135 !radius_msg_add_attr(msg,
136 RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
137 wpabuf_head(b), wpabuf_len(b))) {
138 wpa_printf(MSG_ERROR, "Could not add CUI");
139 goto fail;
140 }
Dmitry Shmidt04949592012-07-19 12:16:46 -0700141
Dmitry Shmidt61d9df32012-08-29 16:22:06 -0700142 if (!b && sta->radius_cui &&
143 !radius_msg_add_attr(msg,
144 RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
145 (u8 *) sta->radius_cui,
146 os_strlen(sta->radius_cui))) {
147 wpa_printf(MSG_ERROR, "Could not add CUI from ACL");
Dmitry Shmidt04949592012-07-19 12:16:46 -0700148 goto fail;
149 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700150 }
151
152 return msg;
153
154 fail:
155 radius_msg_free(msg);
156 return NULL;
157}
158
159
160static int accounting_sta_update_stats(struct hostapd_data *hapd,
161 struct sta_info *sta,
162 struct hostap_sta_driver_data *data)
163{
164 if (hostapd_drv_read_sta_data(hapd, data, sta->addr))
165 return -1;
166
167 if (sta->last_rx_bytes > data->rx_bytes)
168 sta->acct_input_gigawords++;
169 if (sta->last_tx_bytes > data->tx_bytes)
170 sta->acct_output_gigawords++;
171 sta->last_rx_bytes = data->rx_bytes;
172 sta->last_tx_bytes = data->tx_bytes;
173
174 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
175 HOSTAPD_LEVEL_DEBUG, "updated TX/RX stats: "
176 "Acct-Input-Octets=%lu Acct-Input-Gigawords=%u "
177 "Acct-Output-Octets=%lu Acct-Output-Gigawords=%u",
178 sta->last_rx_bytes, sta->acct_input_gigawords,
179 sta->last_tx_bytes, sta->acct_output_gigawords);
180
181 return 0;
182}
183
184
185static void accounting_interim_update(void *eloop_ctx, void *timeout_ctx)
186{
187 struct hostapd_data *hapd = eloop_ctx;
188 struct sta_info *sta = timeout_ctx;
189 int interval;
190
191 if (sta->acct_interim_interval) {
192 accounting_sta_interim(hapd, sta);
193 interval = sta->acct_interim_interval;
194 } else {
195 struct hostap_sta_driver_data data;
196 accounting_sta_update_stats(hapd, sta, &data);
197 interval = ACCT_DEFAULT_UPDATE_INTERVAL;
198 }
199
200 eloop_register_timeout(interval, 0, accounting_interim_update,
201 hapd, sta);
202}
203
204
205/**
206 * accounting_sta_start - Start STA accounting
207 * @hapd: hostapd BSS data
208 * @sta: The station
209 */
210void accounting_sta_start(struct hostapd_data *hapd, struct sta_info *sta)
211{
212 struct radius_msg *msg;
213 int interval;
214
215 if (sta->acct_session_started)
216 return;
217
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700218 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
219 HOSTAPD_LEVEL_INFO,
220 "starting accounting session %08X-%08X",
221 sta->acct_session_id_hi, sta->acct_session_id_lo);
222
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800223 os_get_reltime(&sta->acct_session_start);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700224 sta->last_rx_bytes = sta->last_tx_bytes = 0;
225 sta->acct_input_gigawords = sta->acct_output_gigawords = 0;
226 hostapd_drv_sta_clear_stats(hapd, sta->addr);
227
228 if (!hapd->conf->radius->acct_server)
229 return;
230
231 if (sta->acct_interim_interval)
232 interval = sta->acct_interim_interval;
233 else
234 interval = ACCT_DEFAULT_UPDATE_INTERVAL;
235 eloop_register_timeout(interval, 0, accounting_interim_update,
236 hapd, sta);
237
238 msg = accounting_msg(hapd, sta, RADIUS_ACCT_STATUS_TYPE_START);
Dmitry Shmidt04949592012-07-19 12:16:46 -0700239 if (msg &&
240 radius_client_send(hapd->radius, msg, RADIUS_ACCT, sta->addr) < 0)
241 radius_msg_free(msg);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700242
243 sta->acct_session_started = 1;
244}
245
246
247static void accounting_sta_report(struct hostapd_data *hapd,
248 struct sta_info *sta, int stop)
249{
250 struct radius_msg *msg;
251 int cause = sta->acct_terminate_cause;
252 struct hostap_sta_driver_data data;
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800253 struct os_reltime now_r, diff;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700254 struct os_time now;
255 u32 gigawords;
256
257 if (!hapd->conf->radius->acct_server)
258 return;
259
260 msg = accounting_msg(hapd, sta,
261 stop ? RADIUS_ACCT_STATUS_TYPE_STOP :
262 RADIUS_ACCT_STATUS_TYPE_INTERIM_UPDATE);
263 if (!msg) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -0800264 wpa_printf(MSG_INFO, "Could not create RADIUS Accounting message");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700265 return;
266 }
267
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800268 os_get_reltime(&now_r);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700269 os_get_time(&now);
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800270 os_reltime_sub(&now_r, &sta->acct_session_start, &diff);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700271 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_SESSION_TIME,
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800272 diff.sec)) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -0800273 wpa_printf(MSG_INFO, "Could not add Acct-Session-Time");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700274 goto fail;
275 }
276
277 if (accounting_sta_update_stats(hapd, sta, &data) == 0) {
278 if (!radius_msg_add_attr_int32(msg,
279 RADIUS_ATTR_ACCT_INPUT_PACKETS,
280 data.rx_packets)) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -0800281 wpa_printf(MSG_INFO, "Could not add Acct-Input-Packets");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700282 goto fail;
283 }
284 if (!radius_msg_add_attr_int32(msg,
285 RADIUS_ATTR_ACCT_OUTPUT_PACKETS,
286 data.tx_packets)) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -0800287 wpa_printf(MSG_INFO, "Could not add Acct-Output-Packets");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700288 goto fail;
289 }
290 if (!radius_msg_add_attr_int32(msg,
291 RADIUS_ATTR_ACCT_INPUT_OCTETS,
292 data.rx_bytes)) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -0800293 wpa_printf(MSG_INFO, "Could not add Acct-Input-Octets");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700294 goto fail;
295 }
296 gigawords = sta->acct_input_gigawords;
297#if __WORDSIZE == 64
298 gigawords += data.rx_bytes >> 32;
299#endif
300 if (gigawords &&
301 !radius_msg_add_attr_int32(
302 msg, RADIUS_ATTR_ACCT_INPUT_GIGAWORDS,
303 gigawords)) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -0800304 wpa_printf(MSG_INFO, "Could not add Acct-Input-Gigawords");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700305 goto fail;
306 }
307 if (!radius_msg_add_attr_int32(msg,
308 RADIUS_ATTR_ACCT_OUTPUT_OCTETS,
309 data.tx_bytes)) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -0800310 wpa_printf(MSG_INFO, "Could not add Acct-Output-Octets");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700311 goto fail;
312 }
313 gigawords = sta->acct_output_gigawords;
314#if __WORDSIZE == 64
315 gigawords += data.tx_bytes >> 32;
316#endif
317 if (gigawords &&
318 !radius_msg_add_attr_int32(
319 msg, RADIUS_ATTR_ACCT_OUTPUT_GIGAWORDS,
320 gigawords)) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -0800321 wpa_printf(MSG_INFO, "Could not add Acct-Output-Gigawords");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700322 goto fail;
323 }
324 }
325
326 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_EVENT_TIMESTAMP,
327 now.sec)) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -0800328 wpa_printf(MSG_INFO, "Could not add Event-Timestamp");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700329 goto fail;
330 }
331
332 if (eloop_terminated())
333 cause = RADIUS_ACCT_TERMINATE_CAUSE_ADMIN_REBOOT;
334
335 if (stop && cause &&
336 !radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_TERMINATE_CAUSE,
337 cause)) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -0800338 wpa_printf(MSG_INFO, "Could not add Acct-Terminate-Cause");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700339 goto fail;
340 }
341
Dmitry Shmidt04949592012-07-19 12:16:46 -0700342 if (radius_client_send(hapd->radius, msg,
343 stop ? RADIUS_ACCT : RADIUS_ACCT_INTERIM,
344 sta->addr) < 0)
345 goto fail;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700346 return;
347
348 fail:
349 radius_msg_free(msg);
350}
351
352
353/**
354 * accounting_sta_interim - Send a interim STA accounting report
355 * @hapd: hostapd BSS data
356 * @sta: The station
357 */
Dmitry Shmidt61d9df32012-08-29 16:22:06 -0700358static void accounting_sta_interim(struct hostapd_data *hapd,
359 struct sta_info *sta)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700360{
361 if (sta->acct_session_started)
362 accounting_sta_report(hapd, sta, 0);
363}
364
365
366/**
367 * accounting_sta_stop - Stop STA accounting
368 * @hapd: hostapd BSS data
369 * @sta: The station
370 */
371void accounting_sta_stop(struct hostapd_data *hapd, struct sta_info *sta)
372{
373 if (sta->acct_session_started) {
374 accounting_sta_report(hapd, sta, 1);
375 eloop_cancel_timeout(accounting_interim_update, hapd, sta);
376 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
377 HOSTAPD_LEVEL_INFO,
378 "stopped accounting session %08X-%08X",
379 sta->acct_session_id_hi,
380 sta->acct_session_id_lo);
381 sta->acct_session_started = 0;
382 }
383}
384
385
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -0800386void accounting_sta_get_id(struct hostapd_data *hapd,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700387 struct sta_info *sta)
388{
389 sta->acct_session_id_lo = hapd->acct_session_id_lo++;
390 if (hapd->acct_session_id_lo == 0) {
391 hapd->acct_session_id_hi++;
392 }
393 sta->acct_session_id_hi = hapd->acct_session_id_hi;
394}
395
396
397/**
398 * accounting_receive - Process the RADIUS frames from Accounting Server
399 * @msg: RADIUS response message
400 * @req: RADIUS request message
401 * @shared_secret: RADIUS shared secret
402 * @shared_secret_len: Length of shared_secret in octets
403 * @data: Context data (struct hostapd_data *)
404 * Returns: Processing status
405 */
406static RadiusRxResult
407accounting_receive(struct radius_msg *msg, struct radius_msg *req,
408 const u8 *shared_secret, size_t shared_secret_len,
409 void *data)
410{
411 if (radius_msg_get_hdr(msg)->code != RADIUS_CODE_ACCOUNTING_RESPONSE) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -0800412 wpa_printf(MSG_INFO, "Unknown RADIUS message code");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700413 return RADIUS_RX_UNKNOWN;
414 }
415
416 if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 0)) {
Dmitry Shmidtcce06662013-11-04 18:44:24 -0800417 wpa_printf(MSG_INFO, "Incoming RADIUS packet did not have correct Authenticator - dropped");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700418 return RADIUS_RX_INVALID_AUTHENTICATOR;
419 }
420
421 return RADIUS_RX_PROCESSED;
422}
423
424
425static void accounting_report_state(struct hostapd_data *hapd, int on)
426{
427 struct radius_msg *msg;
428
429 if (!hapd->conf->radius->acct_server || hapd->radius == NULL)
430 return;
431
432 /* Inform RADIUS server that accounting will start/stop so that the
433 * server can close old accounting sessions. */
434 msg = accounting_msg(hapd, NULL,
435 on ? RADIUS_ACCT_STATUS_TYPE_ACCOUNTING_ON :
436 RADIUS_ACCT_STATUS_TYPE_ACCOUNTING_OFF);
437 if (!msg)
438 return;
439
440 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_TERMINATE_CAUSE,
441 RADIUS_ACCT_TERMINATE_CAUSE_NAS_REBOOT))
442 {
Dmitry Shmidtcce06662013-11-04 18:44:24 -0800443 wpa_printf(MSG_INFO, "Could not add Acct-Terminate-Cause");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700444 radius_msg_free(msg);
445 return;
446 }
447
Dmitry Shmidt04949592012-07-19 12:16:46 -0700448 if (radius_client_send(hapd->radius, msg, RADIUS_ACCT, NULL) < 0)
449 radius_msg_free(msg);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700450}
451
452
453/**
454 * accounting_init: Initialize accounting
455 * @hapd: hostapd BSS data
456 * Returns: 0 on success, -1 on failure
457 */
458int accounting_init(struct hostapd_data *hapd)
459{
460 struct os_time now;
461
462 /* Acct-Session-Id should be unique over reboots. If reliable clock is
463 * not available, this could be replaced with reboot counter, etc. */
464 os_get_time(&now);
465 hapd->acct_session_id_hi = now.sec;
466
467 if (radius_client_register(hapd->radius, RADIUS_ACCT,
468 accounting_receive, hapd))
469 return -1;
470
471 accounting_report_state(hapd, 1);
472
473 return 0;
474}
475
476
477/**
478 * accounting_deinit: Deinitilize accounting
479 * @hapd: hostapd BSS data
480 */
481void accounting_deinit(struct hostapd_data *hapd)
482{
483 accounting_report_state(hapd, 0);
484}