1 /*
2  * hostapd / RADIUS Accounting
3  * Copyright (c) 2002-2009, 2012-2015, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "utils/includes.h"
10 
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "eapol_auth/eapol_auth_sm.h"
14 #include "eapol_auth/eapol_auth_sm_i.h"
15 #include "radius/radius.h"
16 #include "radius/radius_client.h"
17 #include "hostapd.h"
18 #include "ieee802_1x.h"
19 #include "ap_config.h"
20 #include "sta_info.h"
21 #include "ap_drv_ops.h"
22 #include "accounting.h"
23 
24 
25 /* Default interval in seconds for polling TX/RX octets from the driver if
26  * STA is not using interim accounting. This detects wrap arounds for
27  * input/output octets and updates Acct-{Input,Output}-Gigawords. */
28 #define ACCT_DEFAULT_UPDATE_INTERVAL 300
29 
30 static void accounting_sta_interim(struct hostapd_data *hapd,
31 				   struct sta_info *sta);
32 
33 
accounting_msg(struct hostapd_data * hapd,struct sta_info * sta,int status_type)34 static struct radius_msg * accounting_msg(struct hostapd_data *hapd,
35 					  struct sta_info *sta,
36 					  int status_type)
37 {
38 	struct radius_msg *msg;
39 	char buf[128];
40 	u8 *val;
41 	size_t len;
42 	int i;
43 	struct wpabuf *b;
44 	struct os_time now;
45 
46 	msg = radius_msg_new(RADIUS_CODE_ACCOUNTING_REQUEST,
47 			     radius_client_get_id(hapd->radius));
48 	if (msg == NULL) {
49 		wpa_printf(MSG_INFO, "Could not create new RADIUS packet");
50 		return NULL;
51 	}
52 
53 	if (radius_msg_make_authenticator(msg) < 0) {
54 		wpa_printf(MSG_INFO, "Could not make Request Authenticator");
55 		goto fail;
56 	}
57 
58 	if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_STATUS_TYPE,
59 				       status_type)) {
60 		wpa_printf(MSG_INFO, "Could not add Acct-Status-Type");
61 		goto fail;
62 	}
63 
64 	if (sta) {
65 		if (!hostapd_config_get_radius_attr(
66 			    hapd->conf->radius_acct_req_attr,
67 			    RADIUS_ATTR_ACCT_AUTHENTIC) &&
68 		    !radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_AUTHENTIC,
69 					       hapd->conf->ieee802_1x ?
70 					       RADIUS_ACCT_AUTHENTIC_RADIUS :
71 					       RADIUS_ACCT_AUTHENTIC_LOCAL)) {
72 			wpa_printf(MSG_INFO, "Could not add Acct-Authentic");
73 			goto fail;
74 		}
75 
76 		/* Use 802.1X identity if available */
77 		val = ieee802_1x_get_identity(sta->eapol_sm, &len);
78 
79 		/* Use RADIUS ACL identity if 802.1X provides no identity */
80 		if (!val && sta->identity) {
81 			val = (u8 *) sta->identity;
82 			len = os_strlen(sta->identity);
83 		}
84 
85 		/* Use STA MAC if neither 802.1X nor RADIUS ACL provided
86 		 * identity */
87 		if (!val) {
88 			os_snprintf(buf, sizeof(buf), RADIUS_ADDR_FORMAT,
89 				    MAC2STR(sta->addr));
90 			val = (u8 *) buf;
91 			len = os_strlen(buf);
92 		}
93 
94 		if (!radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME, val,
95 					 len)) {
96 			wpa_printf(MSG_INFO, "Could not add User-Name");
97 			goto fail;
98 		}
99 	}
100 
101 	if (add_common_radius_attr(hapd, hapd->conf->radius_acct_req_attr, sta,
102 				   msg) < 0)
103 		goto fail;
104 
105 	if (sta) {
106 		for (i = 0; ; i++) {
107 			val = ieee802_1x_get_radius_class(sta->eapol_sm, &len,
108 							  i);
109 			if (val == NULL)
110 				break;
111 
112 			if (!radius_msg_add_attr(msg, RADIUS_ATTR_CLASS,
113 						 val, len)) {
114 				wpa_printf(MSG_INFO, "Could not add Class");
115 				goto fail;
116 			}
117 		}
118 
119 		b = ieee802_1x_get_radius_cui(sta->eapol_sm);
120 		if (b &&
121 		    !radius_msg_add_attr(msg,
122 					 RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
123 					 wpabuf_head(b), wpabuf_len(b))) {
124 			wpa_printf(MSG_ERROR, "Could not add CUI");
125 			goto fail;
126 		}
127 
128 		if (!b && sta->radius_cui &&
129 		    !radius_msg_add_attr(msg,
130 					 RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
131 					 (u8 *) sta->radius_cui,
132 					 os_strlen(sta->radius_cui))) {
133 			wpa_printf(MSG_ERROR, "Could not add CUI from ACL");
134 			goto fail;
135 		}
136 
137 		if (sta->ipaddr &&
138 		    !radius_msg_add_attr_int32(msg,
139 					       RADIUS_ATTR_FRAMED_IP_ADDRESS,
140 					       be_to_host32(sta->ipaddr))) {
141 			wpa_printf(MSG_ERROR,
142 				   "Could not add Framed-IP-Address");
143 			goto fail;
144 		}
145 	}
146 
147 	os_get_time(&now);
148 	if (now.sec > 1000000000 &&
149 	    !radius_msg_add_attr_int32(msg, RADIUS_ATTR_EVENT_TIMESTAMP,
150 				       now.sec)) {
151 		wpa_printf(MSG_INFO, "Could not add Event-Timestamp");
152 		goto fail;
153 	}
154 
155 	/*
156 	 * Add Acct-Delay-Time with zero value for the first transmission. This
157 	 * will be updated within radius_client.c when retransmitting the frame.
158 	 */
159 	if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_DELAY_TIME, 0)) {
160 		wpa_printf(MSG_INFO, "Could not add Acct-Delay-Time");
161 		goto fail;
162 	}
163 
164 	return msg;
165 
166  fail:
167 	radius_msg_free(msg);
168 	return NULL;
169 }
170 
171 
accounting_sta_update_stats(struct hostapd_data * hapd,struct sta_info * sta,struct hostap_sta_driver_data * data)172 static int accounting_sta_update_stats(struct hostapd_data *hapd,
173 				       struct sta_info *sta,
174 				       struct hostap_sta_driver_data *data)
175 {
176 	if (hostapd_drv_read_sta_data(hapd, data, sta->addr))
177 		return -1;
178 
179 	if (!data->bytes_64bit) {
180 		/* Extend 32-bit counters from the driver to 64-bit counters */
181 		if (sta->last_rx_bytes_lo > data->rx_bytes)
182 			sta->last_rx_bytes_hi++;
183 		sta->last_rx_bytes_lo = data->rx_bytes;
184 
185 		if (sta->last_tx_bytes_lo > data->tx_bytes)
186 			sta->last_tx_bytes_hi++;
187 		sta->last_tx_bytes_lo = data->tx_bytes;
188 	}
189 
190 	hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
191 		       HOSTAPD_LEVEL_DEBUG,
192 		       "updated TX/RX stats: rx_bytes=%llu [%u:%u] tx_bytes=%llu [%u:%u] bytes_64bit=%d",
193 		       data->rx_bytes, sta->last_rx_bytes_hi,
194 		       sta->last_rx_bytes_lo,
195 		       data->tx_bytes, sta->last_tx_bytes_hi,
196 		       sta->last_tx_bytes_lo,
197 		       data->bytes_64bit);
198 
199 	return 0;
200 }
201 
202 
accounting_interim_update(void * eloop_ctx,void * timeout_ctx)203 static void accounting_interim_update(void *eloop_ctx, void *timeout_ctx)
204 {
205 	struct hostapd_data *hapd = eloop_ctx;
206 	struct sta_info *sta = timeout_ctx;
207 	int interval;
208 
209 	if (sta->acct_interim_interval) {
210 		accounting_sta_interim(hapd, sta);
211 		interval = sta->acct_interim_interval;
212 	} else {
213 		struct hostap_sta_driver_data data;
214 		accounting_sta_update_stats(hapd, sta, &data);
215 		interval = ACCT_DEFAULT_UPDATE_INTERVAL;
216 	}
217 
218 	eloop_register_timeout(interval, 0, accounting_interim_update,
219 			       hapd, sta);
220 }
221 
222 
223 /**
224  * accounting_sta_start - Start STA accounting
225  * @hapd: hostapd BSS data
226  * @sta: The station
227  */
accounting_sta_start(struct hostapd_data * hapd,struct sta_info * sta)228 void accounting_sta_start(struct hostapd_data *hapd, struct sta_info *sta)
229 {
230 	struct radius_msg *msg;
231 	int interval;
232 
233 	if (sta->acct_session_started)
234 		return;
235 
236 	hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
237 		       HOSTAPD_LEVEL_INFO,
238 		       "starting accounting session %016llX",
239 		       (unsigned long long) sta->acct_session_id);
240 
241 	os_get_reltime(&sta->acct_session_start);
242 	sta->last_rx_bytes_hi = 0;
243 	sta->last_rx_bytes_lo = 0;
244 	sta->last_tx_bytes_hi = 0;
245 	sta->last_tx_bytes_lo = 0;
246 	hostapd_drv_sta_clear_stats(hapd, sta->addr);
247 
248 	if (!hapd->conf->radius->acct_server)
249 		return;
250 
251 	if (sta->acct_interim_interval)
252 		interval = sta->acct_interim_interval;
253 	else
254 		interval = ACCT_DEFAULT_UPDATE_INTERVAL;
255 	eloop_register_timeout(interval, 0, accounting_interim_update,
256 			       hapd, sta);
257 
258 	msg = accounting_msg(hapd, sta, RADIUS_ACCT_STATUS_TYPE_START);
259 	if (msg &&
260 	    radius_client_send(hapd->radius, msg, RADIUS_ACCT, sta->addr) < 0)
261 		radius_msg_free(msg);
262 
263 	sta->acct_session_started = 1;
264 }
265 
266 
accounting_sta_report(struct hostapd_data * hapd,struct sta_info * sta,int stop)267 static void accounting_sta_report(struct hostapd_data *hapd,
268 				  struct sta_info *sta, int stop)
269 {
270 	struct radius_msg *msg;
271 	int cause = sta->acct_terminate_cause;
272 	struct hostap_sta_driver_data data;
273 	struct os_reltime now_r, diff;
274 	u64 bytes;
275 
276 	if (!hapd->conf->radius->acct_server)
277 		return;
278 
279 	msg = accounting_msg(hapd, sta,
280 			     stop ? RADIUS_ACCT_STATUS_TYPE_STOP :
281 			     RADIUS_ACCT_STATUS_TYPE_INTERIM_UPDATE);
282 	if (!msg) {
283 		wpa_printf(MSG_INFO, "Could not create RADIUS Accounting message");
284 		return;
285 	}
286 
287 	os_get_reltime(&now_r);
288 	os_reltime_sub(&now_r, &sta->acct_session_start, &diff);
289 	if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_SESSION_TIME,
290 				       diff.sec)) {
291 		wpa_printf(MSG_INFO, "Could not add Acct-Session-Time");
292 		goto fail;
293 	}
294 
295 	if (accounting_sta_update_stats(hapd, sta, &data) == 0) {
296 		if (!radius_msg_add_attr_int32(msg,
297 					       RADIUS_ATTR_ACCT_INPUT_PACKETS,
298 					       data.rx_packets)) {
299 			wpa_printf(MSG_INFO, "Could not add Acct-Input-Packets");
300 			goto fail;
301 		}
302 		if (!radius_msg_add_attr_int32(msg,
303 					       RADIUS_ATTR_ACCT_OUTPUT_PACKETS,
304 					       data.tx_packets)) {
305 			wpa_printf(MSG_INFO, "Could not add Acct-Output-Packets");
306 			goto fail;
307 		}
308 		if (data.bytes_64bit)
309 			bytes = data.rx_bytes;
310 		else
311 			bytes = ((u64) sta->last_rx_bytes_hi << 32) |
312 				sta->last_rx_bytes_lo;
313 		if (!radius_msg_add_attr_int32(msg,
314 					       RADIUS_ATTR_ACCT_INPUT_OCTETS,
315 					       (u32) bytes)) {
316 			wpa_printf(MSG_INFO, "Could not add Acct-Input-Octets");
317 			goto fail;
318 		}
319 		if (!radius_msg_add_attr_int32(msg,
320 					       RADIUS_ATTR_ACCT_INPUT_GIGAWORDS,
321 					       (u32) (bytes >> 32))) {
322 			wpa_printf(MSG_INFO, "Could not add Acct-Input-Gigawords");
323 			goto fail;
324 		}
325 		if (data.bytes_64bit)
326 			bytes = data.tx_bytes;
327 		else
328 			bytes = ((u64) sta->last_tx_bytes_hi << 32) |
329 				sta->last_tx_bytes_lo;
330 		if (!radius_msg_add_attr_int32(msg,
331 					       RADIUS_ATTR_ACCT_OUTPUT_OCTETS,
332 					       (u32) bytes)) {
333 			wpa_printf(MSG_INFO, "Could not add Acct-Output-Octets");
334 			goto fail;
335 		}
336 		if (!radius_msg_add_attr_int32(msg,
337 					       RADIUS_ATTR_ACCT_OUTPUT_GIGAWORDS,
338 					       (u32) (bytes >> 32))) {
339 			wpa_printf(MSG_INFO, "Could not add Acct-Output-Gigawords");
340 			goto fail;
341 		}
342 	}
343 
344 	if (eloop_terminated())
345 		cause = RADIUS_ACCT_TERMINATE_CAUSE_ADMIN_REBOOT;
346 
347 	if (stop && cause &&
348 	    !radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_TERMINATE_CAUSE,
349 				       cause)) {
350 		wpa_printf(MSG_INFO, "Could not add Acct-Terminate-Cause");
351 		goto fail;
352 	}
353 
354 	if (radius_client_send(hapd->radius, msg,
355 			       stop ? RADIUS_ACCT : RADIUS_ACCT_INTERIM,
356 			       sta->addr) < 0)
357 		goto fail;
358 	return;
359 
360  fail:
361 	radius_msg_free(msg);
362 }
363 
364 
365 /**
366  * accounting_sta_interim - Send a interim STA accounting report
367  * @hapd: hostapd BSS data
368  * @sta: The station
369  */
accounting_sta_interim(struct hostapd_data * hapd,struct sta_info * sta)370 static void accounting_sta_interim(struct hostapd_data *hapd,
371 				   struct sta_info *sta)
372 {
373 	if (sta->acct_session_started)
374 		accounting_sta_report(hapd, sta, 0);
375 }
376 
377 
378 /**
379  * accounting_sta_stop - Stop STA accounting
380  * @hapd: hostapd BSS data
381  * @sta: The station
382  */
accounting_sta_stop(struct hostapd_data * hapd,struct sta_info * sta)383 void accounting_sta_stop(struct hostapd_data *hapd, struct sta_info *sta)
384 {
385 	if (sta->acct_session_started) {
386 		accounting_sta_report(hapd, sta, 1);
387 		eloop_cancel_timeout(accounting_interim_update, hapd, sta);
388 		hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
389 			       HOSTAPD_LEVEL_INFO,
390 			       "stopped accounting session %016llX",
391 			       (unsigned long long) sta->acct_session_id);
392 		sta->acct_session_started = 0;
393 	}
394 }
395 
396 
accounting_sta_get_id(struct hostapd_data * hapd,struct sta_info * sta)397 int accounting_sta_get_id(struct hostapd_data *hapd, struct sta_info *sta)
398 {
399 	return radius_gen_session_id((u8 *) &sta->acct_session_id,
400 				     sizeof(sta->acct_session_id));
401 }
402 
403 
404 /**
405  * accounting_receive - Process the RADIUS frames from Accounting Server
406  * @msg: RADIUS response message
407  * @req: RADIUS request message
408  * @shared_secret: RADIUS shared secret
409  * @shared_secret_len: Length of shared_secret in octets
410  * @data: Context data (struct hostapd_data *)
411  * Returns: Processing status
412  */
413 static RadiusRxResult
accounting_receive(struct radius_msg * msg,struct radius_msg * req,const u8 * shared_secret,size_t shared_secret_len,void * data)414 accounting_receive(struct radius_msg *msg, struct radius_msg *req,
415 		   const u8 *shared_secret, size_t shared_secret_len,
416 		   void *data)
417 {
418 	if (radius_msg_get_hdr(msg)->code != RADIUS_CODE_ACCOUNTING_RESPONSE) {
419 		wpa_printf(MSG_INFO, "Unknown RADIUS message code");
420 		return RADIUS_RX_UNKNOWN;
421 	}
422 
423 	if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 0)) {
424 		wpa_printf(MSG_INFO, "Incoming RADIUS packet did not have correct Authenticator - dropped");
425 		return RADIUS_RX_INVALID_AUTHENTICATOR;
426 	}
427 
428 	return RADIUS_RX_PROCESSED;
429 }
430 
431 
accounting_report_state(struct hostapd_data * hapd,int on)432 static void accounting_report_state(struct hostapd_data *hapd, int on)
433 {
434 	struct radius_msg *msg;
435 
436 	if (!hapd->conf->radius->acct_server || hapd->radius == NULL)
437 		return;
438 
439 	/* Inform RADIUS server that accounting will start/stop so that the
440 	 * server can close old accounting sessions. */
441 	msg = accounting_msg(hapd, NULL,
442 			     on ? RADIUS_ACCT_STATUS_TYPE_ACCOUNTING_ON :
443 			     RADIUS_ACCT_STATUS_TYPE_ACCOUNTING_OFF);
444 	if (!msg)
445 		return;
446 
447 	if (hapd->acct_session_id) {
448 		char buf[20];
449 
450 		os_snprintf(buf, sizeof(buf), "%016llX",
451 			    (unsigned long long) hapd->acct_session_id);
452 		if (!radius_msg_add_attr(msg, RADIUS_ATTR_ACCT_SESSION_ID,
453 					 (u8 *) buf, os_strlen(buf)))
454 			wpa_printf(MSG_ERROR, "Could not add Acct-Session-Id");
455 	}
456 
457 	if (radius_client_send(hapd->radius, msg, RADIUS_ACCT, NULL) < 0)
458 		radius_msg_free(msg);
459 }
460 
461 
accounting_interim_error_cb(const u8 * addr,void * ctx)462 static void accounting_interim_error_cb(const u8 *addr, void *ctx)
463 {
464 	struct hostapd_data *hapd = ctx;
465 	struct sta_info *sta;
466 	unsigned int i, wait_time;
467 	int res;
468 
469 	sta = ap_get_sta(hapd, addr);
470 	if (!sta)
471 		return;
472 	sta->acct_interim_errors++;
473 	if (sta->acct_interim_errors > 10 /* RADIUS_CLIENT_MAX_RETRIES */) {
474 		wpa_printf(MSG_DEBUG,
475 			   "Interim RADIUS accounting update failed for " MACSTR
476 			   " - too many errors, abandon this interim accounting update",
477 			   MAC2STR(addr));
478 		sta->acct_interim_errors = 0;
479 		/* Next update will be tried after normal update interval */
480 		return;
481 	}
482 
483 	/*
484 	 * Use a shorter update interval as an improved retransmission mechanism
485 	 * for failed interim accounting updates. This allows the statistics to
486 	 * be updated for each retransmission.
487 	 *
488 	 * RADIUS client code has already waited RADIUS_CLIENT_FIRST_WAIT.
489 	 * Schedule the first retry attempt immediately and every following one
490 	 * with exponential backoff.
491 	 */
492 	if (sta->acct_interim_errors == 1) {
493 		wait_time = 0;
494 	} else {
495 		wait_time = 3; /* RADIUS_CLIENT_FIRST_WAIT */
496 		for (i = 1; i < sta->acct_interim_errors; i++)
497 			wait_time *= 2;
498 	}
499 	res = eloop_deplete_timeout(wait_time, 0, accounting_interim_update,
500 				    hapd, sta);
501 	if (res == 1)
502 		wpa_printf(MSG_DEBUG,
503 			   "Interim RADIUS accounting update failed for " MACSTR
504 			   " (error count: %u) - schedule next update in %u seconds",
505 			   MAC2STR(addr), sta->acct_interim_errors, wait_time);
506 	else if (res == 0)
507 		wpa_printf(MSG_DEBUG,
508 			   "Interim RADIUS accounting update failed for " MACSTR
509 			   " (error count: %u)", MAC2STR(addr),
510 			   sta->acct_interim_errors);
511 	else
512 		wpa_printf(MSG_DEBUG,
513 			   "Interim RADIUS accounting update failed for " MACSTR
514 			   " (error count: %u) - no timer found", MAC2STR(addr),
515 			   sta->acct_interim_errors);
516 }
517 
518 
519 /**
520  * accounting_init: Initialize accounting
521  * @hapd: hostapd BSS data
522  * Returns: 0 on success, -1 on failure
523  */
accounting_init(struct hostapd_data * hapd)524 int accounting_init(struct hostapd_data *hapd)
525 {
526 	if (radius_gen_session_id((u8 *) &hapd->acct_session_id,
527 				  sizeof(hapd->acct_session_id)) < 0)
528 		return -1;
529 
530 	if (radius_client_register(hapd->radius, RADIUS_ACCT,
531 				   accounting_receive, hapd))
532 		return -1;
533 	radius_client_set_interim_error_cb(hapd->radius,
534 					   accounting_interim_error_cb, hapd);
535 
536 	accounting_report_state(hapd, 1);
537 
538 	return 0;
539 }
540 
541 
542 /**
543  * accounting_deinit: Deinitialize accounting
544  * @hapd: hostapd BSS data
545  */
accounting_deinit(struct hostapd_data * hapd)546 void accounting_deinit(struct hostapd_data *hapd)
547 {
548 	accounting_report_state(hapd, 0);
549 }
550