1 /* 2 * hostapd / RADIUS Accounting 3 * Copyright (c) 2002-2009, 2012-2015, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "utils/includes.h" 10 11 #include "utils/common.h" 12 #include "utils/eloop.h" 13 #include "eapol_auth/eapol_auth_sm.h" 14 #include "eapol_auth/eapol_auth_sm_i.h" 15 #include "radius/radius.h" 16 #include "radius/radius_client.h" 17 #include "hostapd.h" 18 #include "ieee802_1x.h" 19 #include "ap_config.h" 20 #include "sta_info.h" 21 #include "ap_drv_ops.h" 22 #include "accounting.h" 23 24 25 /* Default interval in seconds for polling TX/RX octets from the driver if 26 * STA is not using interim accounting. This detects wrap arounds for 27 * input/output octets and updates Acct-{Input,Output}-Gigawords. */ 28 #define ACCT_DEFAULT_UPDATE_INTERVAL 300 29 30 static void accounting_sta_interim(struct hostapd_data *hapd, 31 struct sta_info *sta); 32 33 34 static struct radius_msg * accounting_msg(struct hostapd_data *hapd, 35 struct sta_info *sta, 36 int status_type) 37 { 38 struct radius_msg *msg; 39 char buf[128]; 40 u8 *val; 41 size_t len; 42 int i; 43 struct wpabuf *b; 44 struct os_time now; 45 46 msg = radius_msg_new(RADIUS_CODE_ACCOUNTING_REQUEST, 47 radius_client_get_id(hapd->radius)); 48 if (msg == NULL) { 49 wpa_printf(MSG_INFO, "Could not create new RADIUS packet"); 50 return NULL; 51 } 52 53 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_STATUS_TYPE, 54 status_type)) { 55 wpa_printf(MSG_INFO, "Could not add Acct-Status-Type"); 56 goto fail; 57 } 58 59 if (sta) { 60 if (!hostapd_config_get_radius_attr( 61 hapd->conf->radius_acct_req_attr, 62 RADIUS_ATTR_ACCT_AUTHENTIC) && 63 !radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_AUTHENTIC, 64 hapd->conf->ieee802_1x ? 65 RADIUS_ACCT_AUTHENTIC_RADIUS : 66 RADIUS_ACCT_AUTHENTIC_LOCAL)) { 67 wpa_printf(MSG_INFO, "Could not add Acct-Authentic"); 68 goto fail; 69 } 70 71 /* Use 802.1X identity if available */ 72 val = ieee802_1x_get_identity(sta->eapol_sm, &len); 73 74 /* Use RADIUS ACL identity if 802.1X provides no identity */ 75 if (!val && sta->identity) { 76 val = (u8 *) sta->identity; 77 len = os_strlen(sta->identity); 78 } 79 80 /* Use STA MAC if neither 802.1X nor RADIUS ACL provided 81 * identity */ 82 if (!val) { 83 os_snprintf(buf, sizeof(buf), RADIUS_ADDR_FORMAT, 84 MAC2STR(sta->addr)); 85 val = (u8 *) buf; 86 len = os_strlen(buf); 87 } 88 89 if (!radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME, val, 90 len)) { 91 wpa_printf(MSG_INFO, "Could not add User-Name"); 92 goto fail; 93 } 94 } 95 96 if (add_common_radius_attr(hapd, hapd->conf->radius_acct_req_attr, sta, 97 msg) < 0) 98 goto fail; 99 100 if (sta && add_sqlite_radius_attr(hapd, sta, msg, 1) < 0) 101 goto fail; 102 103 if (sta) { 104 for (i = 0; ; i++) { 105 val = ieee802_1x_get_radius_class(sta->eapol_sm, &len, 106 i); 107 if (val == NULL) 108 break; 109 110 if (!radius_msg_add_attr(msg, RADIUS_ATTR_CLASS, 111 val, len)) { 112 wpa_printf(MSG_INFO, "Could not add Class"); 113 goto fail; 114 } 115 } 116 117 b = ieee802_1x_get_radius_cui(sta->eapol_sm); 118 if (b && 119 !radius_msg_add_attr(msg, 120 RADIUS_ATTR_CHARGEABLE_USER_IDENTITY, 121 wpabuf_head(b), wpabuf_len(b))) { 122 wpa_printf(MSG_ERROR, "Could not add CUI"); 123 goto fail; 124 } 125 126 if (!b && sta->radius_cui && 127 !radius_msg_add_attr(msg, 128 RADIUS_ATTR_CHARGEABLE_USER_IDENTITY, 129 (u8 *) sta->radius_cui, 130 os_strlen(sta->radius_cui))) { 131 wpa_printf(MSG_ERROR, "Could not add CUI from ACL"); 132 goto fail; 133 } 134 135 if (sta->ipaddr && 136 !radius_msg_add_attr_int32(msg, 137 RADIUS_ATTR_FRAMED_IP_ADDRESS, 138 be_to_host32(sta->ipaddr))) { 139 wpa_printf(MSG_ERROR, 140 "Could not add Framed-IP-Address"); 141 goto fail; 142 } 143 } 144 145 os_get_time(&now); 146 if (now.sec > 1000000000 && 147 !radius_msg_add_attr_int32(msg, RADIUS_ATTR_EVENT_TIMESTAMP, 148 now.sec)) { 149 wpa_printf(MSG_INFO, "Could not add Event-Timestamp"); 150 goto fail; 151 } 152 153 /* 154 * Add Acct-Delay-Time with zero value for the first transmission. This 155 * will be updated within radius_client.c when retransmitting the frame. 156 */ 157 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_DELAY_TIME, 0)) { 158 wpa_printf(MSG_INFO, "Could not add Acct-Delay-Time"); 159 goto fail; 160 } 161 162 return msg; 163 164 fail: 165 radius_msg_free(msg); 166 return NULL; 167 } 168 169 170 static int accounting_sta_update_stats(struct hostapd_data *hapd, 171 struct sta_info *sta, 172 struct hostap_sta_driver_data *data) 173 { 174 if (hostapd_drv_read_sta_data(hapd, data, sta->addr)) 175 return -1; 176 177 if (!data->bytes_64bit) { 178 /* Extend 32-bit counters from the driver to 64-bit counters */ 179 if (sta->last_rx_bytes_lo > data->rx_bytes) 180 sta->last_rx_bytes_hi++; 181 sta->last_rx_bytes_lo = data->rx_bytes; 182 183 if (sta->last_tx_bytes_lo > data->tx_bytes) 184 sta->last_tx_bytes_hi++; 185 sta->last_tx_bytes_lo = data->tx_bytes; 186 } 187 188 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS, 189 HOSTAPD_LEVEL_DEBUG, 190 "updated TX/RX stats: rx_bytes=%llu [%u:%u] tx_bytes=%llu [%u:%u] bytes_64bit=%d", 191 data->rx_bytes, sta->last_rx_bytes_hi, 192 sta->last_rx_bytes_lo, 193 data->tx_bytes, sta->last_tx_bytes_hi, 194 sta->last_tx_bytes_lo, 195 data->bytes_64bit); 196 197 return 0; 198 } 199 200 201 static void accounting_interim_update(void *eloop_ctx, void *timeout_ctx) 202 { 203 struct hostapd_data *hapd = eloop_ctx; 204 struct sta_info *sta = timeout_ctx; 205 int interval; 206 207 if (sta->acct_interim_interval) { 208 accounting_sta_interim(hapd, sta); 209 interval = sta->acct_interim_interval; 210 } else { 211 struct hostap_sta_driver_data data; 212 accounting_sta_update_stats(hapd, sta, &data); 213 interval = ACCT_DEFAULT_UPDATE_INTERVAL; 214 } 215 216 eloop_register_timeout(interval, 0, accounting_interim_update, 217 hapd, sta); 218 } 219 220 221 /** 222 * accounting_sta_start - Start STA accounting 223 * @hapd: hostapd BSS data 224 * @sta: The station 225 */ 226 void accounting_sta_start(struct hostapd_data *hapd, struct sta_info *sta) 227 { 228 struct radius_msg *msg; 229 int interval; 230 231 if (sta->acct_session_started) 232 return; 233 234 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS, 235 HOSTAPD_LEVEL_INFO, 236 "starting accounting session %016llX", 237 (unsigned long long) sta->acct_session_id); 238 239 os_get_reltime(&sta->acct_session_start); 240 sta->last_rx_bytes_hi = 0; 241 sta->last_rx_bytes_lo = 0; 242 sta->last_tx_bytes_hi = 0; 243 sta->last_tx_bytes_lo = 0; 244 hostapd_drv_sta_clear_stats(hapd, sta->addr); 245 246 if (!hapd->conf->radius->acct_server) 247 return; 248 249 if (sta->acct_interim_interval) 250 interval = sta->acct_interim_interval; 251 else 252 interval = ACCT_DEFAULT_UPDATE_INTERVAL; 253 eloop_register_timeout(interval, 0, accounting_interim_update, 254 hapd, sta); 255 256 msg = accounting_msg(hapd, sta, RADIUS_ACCT_STATUS_TYPE_START); 257 if (msg && 258 radius_client_send(hapd->radius, msg, RADIUS_ACCT, sta->addr) < 0) 259 radius_msg_free(msg); 260 261 sta->acct_session_started = 1; 262 } 263 264 265 static void accounting_sta_report(struct hostapd_data *hapd, 266 struct sta_info *sta, int stop) 267 { 268 struct radius_msg *msg; 269 int cause = sta->acct_terminate_cause; 270 struct hostap_sta_driver_data data; 271 struct os_reltime now_r, diff; 272 u64 bytes; 273 274 if (!hapd->conf->radius->acct_server) 275 return; 276 277 msg = accounting_msg(hapd, sta, 278 stop ? RADIUS_ACCT_STATUS_TYPE_STOP : 279 RADIUS_ACCT_STATUS_TYPE_INTERIM_UPDATE); 280 if (!msg) { 281 wpa_printf(MSG_INFO, "Could not create RADIUS Accounting message"); 282 return; 283 } 284 285 os_get_reltime(&now_r); 286 os_reltime_sub(&now_r, &sta->acct_session_start, &diff); 287 if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_SESSION_TIME, 288 diff.sec)) { 289 wpa_printf(MSG_INFO, "Could not add Acct-Session-Time"); 290 goto fail; 291 } 292 293 if (accounting_sta_update_stats(hapd, sta, &data) == 0) { 294 if (!radius_msg_add_attr_int32(msg, 295 RADIUS_ATTR_ACCT_INPUT_PACKETS, 296 data.rx_packets)) { 297 wpa_printf(MSG_INFO, "Could not add Acct-Input-Packets"); 298 goto fail; 299 } 300 if (!radius_msg_add_attr_int32(msg, 301 RADIUS_ATTR_ACCT_OUTPUT_PACKETS, 302 data.tx_packets)) { 303 wpa_printf(MSG_INFO, "Could not add Acct-Output-Packets"); 304 goto fail; 305 } 306 if (data.bytes_64bit) 307 bytes = data.rx_bytes; 308 else 309 bytes = ((u64) sta->last_rx_bytes_hi << 32) | 310 sta->last_rx_bytes_lo; 311 if (!radius_msg_add_attr_int32(msg, 312 RADIUS_ATTR_ACCT_INPUT_OCTETS, 313 (u32) bytes)) { 314 wpa_printf(MSG_INFO, "Could not add Acct-Input-Octets"); 315 goto fail; 316 } 317 if (!radius_msg_add_attr_int32(msg, 318 RADIUS_ATTR_ACCT_INPUT_GIGAWORDS, 319 (u32) (bytes >> 32))) { 320 wpa_printf(MSG_INFO, "Could not add Acct-Input-Gigawords"); 321 goto fail; 322 } 323 if (data.bytes_64bit) 324 bytes = data.tx_bytes; 325 else 326 bytes = ((u64) sta->last_tx_bytes_hi << 32) | 327 sta->last_tx_bytes_lo; 328 if (!radius_msg_add_attr_int32(msg, 329 RADIUS_ATTR_ACCT_OUTPUT_OCTETS, 330 (u32) bytes)) { 331 wpa_printf(MSG_INFO, "Could not add Acct-Output-Octets"); 332 goto fail; 333 } 334 if (!radius_msg_add_attr_int32(msg, 335 RADIUS_ATTR_ACCT_OUTPUT_GIGAWORDS, 336 (u32) (bytes >> 32))) { 337 wpa_printf(MSG_INFO, "Could not add Acct-Output-Gigawords"); 338 goto fail; 339 } 340 } 341 342 if (eloop_terminated()) 343 cause = RADIUS_ACCT_TERMINATE_CAUSE_ADMIN_REBOOT; 344 345 if (stop && cause && 346 !radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_TERMINATE_CAUSE, 347 cause)) { 348 wpa_printf(MSG_INFO, "Could not add Acct-Terminate-Cause"); 349 goto fail; 350 } 351 352 if (radius_client_send(hapd->radius, msg, 353 stop ? RADIUS_ACCT : RADIUS_ACCT_INTERIM, 354 sta->addr) < 0) 355 goto fail; 356 return; 357 358 fail: 359 radius_msg_free(msg); 360 } 361 362 363 /** 364 * accounting_sta_interim - Send a interim STA accounting report 365 * @hapd: hostapd BSS data 366 * @sta: The station 367 */ 368 static void accounting_sta_interim(struct hostapd_data *hapd, 369 struct sta_info *sta) 370 { 371 if (sta->acct_session_started) 372 accounting_sta_report(hapd, sta, 0); 373 } 374 375 376 /** 377 * accounting_sta_stop - Stop STA accounting 378 * @hapd: hostapd BSS data 379 * @sta: The station 380 */ 381 void accounting_sta_stop(struct hostapd_data *hapd, struct sta_info *sta) 382 { 383 if (sta->acct_session_started) { 384 accounting_sta_report(hapd, sta, 1); 385 eloop_cancel_timeout(accounting_interim_update, hapd, sta); 386 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS, 387 HOSTAPD_LEVEL_INFO, 388 "stopped accounting session %016llX", 389 (unsigned long long) sta->acct_session_id); 390 sta->acct_session_started = 0; 391 } 392 } 393 394 395 int accounting_sta_get_id(struct hostapd_data *hapd, struct sta_info *sta) 396 { 397 return radius_gen_session_id((u8 *) &sta->acct_session_id, 398 sizeof(sta->acct_session_id)); 399 } 400 401 402 /** 403 * accounting_receive - Process the RADIUS frames from Accounting Server 404 * @msg: RADIUS response message 405 * @req: RADIUS request message 406 * @shared_secret: RADIUS shared secret 407 * @shared_secret_len: Length of shared_secret in octets 408 * @data: Context data (struct hostapd_data *) 409 * Returns: Processing status 410 */ 411 static RadiusRxResult 412 accounting_receive(struct radius_msg *msg, struct radius_msg *req, 413 const u8 *shared_secret, size_t shared_secret_len, 414 void *data) 415 { 416 if (radius_msg_get_hdr(msg)->code != RADIUS_CODE_ACCOUNTING_RESPONSE) { 417 wpa_printf(MSG_INFO, "Unknown RADIUS message code"); 418 return RADIUS_RX_UNKNOWN; 419 } 420 421 if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 0)) { 422 wpa_printf(MSG_INFO, "Incoming RADIUS packet did not have correct Authenticator - dropped"); 423 return RADIUS_RX_INVALID_AUTHENTICATOR; 424 } 425 426 return RADIUS_RX_PROCESSED; 427 } 428 429 430 static void accounting_report_state(struct hostapd_data *hapd, int on) 431 { 432 struct radius_msg *msg; 433 434 if (!hapd->conf->radius->acct_server || hapd->radius == NULL) 435 return; 436 437 /* Inform RADIUS server that accounting will start/stop so that the 438 * server can close old accounting sessions. */ 439 msg = accounting_msg(hapd, NULL, 440 on ? RADIUS_ACCT_STATUS_TYPE_ACCOUNTING_ON : 441 RADIUS_ACCT_STATUS_TYPE_ACCOUNTING_OFF); 442 if (!msg) 443 return; 444 445 if (hapd->acct_session_id) { 446 char buf[20]; 447 448 os_snprintf(buf, sizeof(buf), "%016llX", 449 (unsigned long long) hapd->acct_session_id); 450 if (!radius_msg_add_attr(msg, RADIUS_ATTR_ACCT_SESSION_ID, 451 (u8 *) buf, os_strlen(buf))) 452 wpa_printf(MSG_ERROR, "Could not add Acct-Session-Id"); 453 } 454 455 if (radius_client_send(hapd->radius, msg, RADIUS_ACCT, NULL) < 0) 456 radius_msg_free(msg); 457 } 458 459 460 static void accounting_interim_error_cb(const u8 *addr, void *ctx) 461 { 462 struct hostapd_data *hapd = ctx; 463 struct sta_info *sta; 464 unsigned int i, wait_time; 465 int res; 466 467 sta = ap_get_sta(hapd, addr); 468 if (!sta) 469 return; 470 sta->acct_interim_errors++; 471 if (sta->acct_interim_errors > 10 /* RADIUS_CLIENT_MAX_RETRIES */) { 472 wpa_printf(MSG_DEBUG, 473 "Interim RADIUS accounting update failed for " MACSTR 474 " - too many errors, abandon this interim accounting update", 475 MAC2STR(addr)); 476 sta->acct_interim_errors = 0; 477 /* Next update will be tried after normal update interval */ 478 return; 479 } 480 481 /* 482 * Use a shorter update interval as an improved retransmission mechanism 483 * for failed interim accounting updates. This allows the statistics to 484 * be updated for each retransmission. 485 * 486 * RADIUS client code has already waited RADIUS_CLIENT_FIRST_WAIT. 487 * Schedule the first retry attempt immediately and every following one 488 * with exponential backoff. 489 */ 490 if (sta->acct_interim_errors == 1) { 491 wait_time = 0; 492 } else { 493 wait_time = 3; /* RADIUS_CLIENT_FIRST_WAIT */ 494 for (i = 1; i < sta->acct_interim_errors; i++) 495 wait_time *= 2; 496 } 497 res = eloop_deplete_timeout(wait_time, 0, accounting_interim_update, 498 hapd, sta); 499 if (res == 1) 500 wpa_printf(MSG_DEBUG, 501 "Interim RADIUS accounting update failed for " MACSTR 502 " (error count: %u) - schedule next update in %u seconds", 503 MAC2STR(addr), sta->acct_interim_errors, wait_time); 504 else if (res == 0) 505 wpa_printf(MSG_DEBUG, 506 "Interim RADIUS accounting update failed for " MACSTR 507 " (error count: %u)", MAC2STR(addr), 508 sta->acct_interim_errors); 509 else 510 wpa_printf(MSG_DEBUG, 511 "Interim RADIUS accounting update failed for " MACSTR 512 " (error count: %u) - no timer found", MAC2STR(addr), 513 sta->acct_interim_errors); 514 } 515 516 517 /** 518 * accounting_init: Initialize accounting 519 * @hapd: hostapd BSS data 520 * Returns: 0 on success, -1 on failure 521 */ 522 int accounting_init(struct hostapd_data *hapd) 523 { 524 if (radius_gen_session_id((u8 *) &hapd->acct_session_id, 525 sizeof(hapd->acct_session_id)) < 0) 526 return -1; 527 528 if (radius_client_register(hapd->radius, RADIUS_ACCT, 529 accounting_receive, hapd)) 530 return -1; 531 radius_client_set_interim_error_cb(hapd->radius, 532 accounting_interim_error_cb, hapd); 533 534 accounting_report_state(hapd, 1); 535 536 return 0; 537 } 538 539 540 /** 541 * accounting_deinit: Deinitialize accounting 542 * @hapd: hostapd BSS data 543 */ 544 void accounting_deinit(struct hostapd_data *hapd) 545 { 546 accounting_report_state(hapd, 0); 547 } 548