src/ap/accounting.c

   1 /*
   2  * hostapd / RADIUS Accounting
   3  * Copyright (c) 2002-2009, 2012-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #include "utils/common.h"
  12 #include "utils/eloop.h"
  13 #include "eapol_auth/eapol_auth_sm.h"
  14 #include "eapol_auth/eapol_auth_sm_i.h"
  15 #include "radius/radius.h"
  16 #include "radius/radius_client.h"
  17 #include "hostapd.h"
  18 #include "ieee802_1x.h"
  19 #include "ap_config.h"
  20 #include "sta_info.h"
  21 #include "ap_drv_ops.h"
  22 #include "accounting.h"
  23
  24
  25 /* Default interval in seconds for polling TX/RX octets from the driver if
  26  * STA is not using interim accounting. This detects wrap arounds for
  27  * input/output octets and updates Acct-{Input,Output}-Gigawords. */
  28 #define ACCT_DEFAULT_UPDATE_INTERVAL 300
  29
  30 static void accounting_sta_interim(struct hostapd_data *hapd,
  31                                    struct sta_info *sta);
  32
  33
  34 static struct radius_msg * accounting_msg(struct hostapd_data *hapd,
  35                                           struct sta_info *sta,
  36                                           int status_type)
  37 {
  38         struct radius_msg *msg;
  39         char buf[128];
  40         u8 *val;
  41         size_t len;
  42         int i;
  43         struct wpabuf *b;
  44
  45         msg = radius_msg_new(RADIUS_CODE_ACCOUNTING_REQUEST,
  46                              radius_client_get_id(hapd->radius));
  47         if (msg == NULL) {
  48                 wpa_printf(MSG_INFO, "Could not create new RADIUS packet");
  49                 return NULL;
  50         }
  51
  52         if (sta) {
  53                 radius_msg_make_authenticator(msg, (u8 *) sta, sizeof(*sta));
  54
  55                 if ((hapd->conf->wpa & 2) &&
  56                     !hapd->conf->disable_pmksa_caching &&
  57                     sta->eapol_sm && sta->eapol_sm->acct_multi_session_id_hi) {
  58                         os_snprintf(buf, sizeof(buf), "%08X+%08X",
  59                                     sta->eapol_sm->acct_multi_session_id_hi,
  60                                     sta->eapol_sm->acct_multi_session_id_lo);
  61                         if (!radius_msg_add_attr(
  62                                     msg, RADIUS_ATTR_ACCT_MULTI_SESSION_ID,
  63                                     (u8 *) buf, os_strlen(buf))) {
  64                                 wpa_printf(MSG_INFO,
  65                                            "Could not add Acct-Multi-Session-Id");
  66                                 goto fail;
  67                         }
  68                 }
  69         } else {
  70                 radius_msg_make_authenticator(msg, (u8 *) hapd, sizeof(*hapd));
  71         }
  72
  73         if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_STATUS_TYPE,
  74                                        status_type)) {
  75                 wpa_printf(MSG_INFO, "Could not add Acct-Status-Type");
  76                 goto fail;
  77         }
  78
  79         if (sta) {
  80                 if (!hostapd_config_get_radius_attr(
  81                             hapd->conf->radius_acct_req_attr,
  82                             RADIUS_ATTR_ACCT_AUTHENTIC) &&
  83                     !radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_AUTHENTIC,
  84                                                hapd->conf->ieee802_1x ?
  85                                                RADIUS_ACCT_AUTHENTIC_RADIUS :
  86                                                RADIUS_ACCT_AUTHENTIC_LOCAL)) {
  87                         wpa_printf(MSG_INFO, "Could not add Acct-Authentic");
  88                         goto fail;
  89                 }
  90
  91                 /* Use 802.1X identity if available */
  92                 val = ieee802_1x_get_identity(sta->eapol_sm, &len);
  93
  94                 /* Use RADIUS ACL identity if 802.1X provides no identity */
  95                 if (!val && sta->identity) {
  96                         val = (u8 *) sta->identity;
  97                         len = os_strlen(sta->identity);
  98                 }
  99
 100                 /* Use STA MAC if neither 802.1X nor RADIUS ACL provided
 101                  * identity */
 102                 if (!val) {
 103                         os_snprintf(buf, sizeof(buf), RADIUS_ADDR_FORMAT,
 104                                     MAC2STR(sta->addr));
 105                         val = (u8 *) buf;
 106                         len = os_strlen(buf);
 107                 }
 108
 109                 if (!radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME, val,
 110                                          len)) {
 111                         wpa_printf(MSG_INFO, "Could not add User-Name");
 112                         goto fail;
 113                 }
 114         }
 115
 116         if (add_common_radius_attr(hapd, hapd->conf->radius_acct_req_attr, sta,
 117                                    msg) < 0)
 118                 goto fail;
 119
 120         if (sta) {
 121                 for (i = 0; ; i++) {
 122                         val = ieee802_1x_get_radius_class(sta->eapol_sm, &len,
 123                                                           i);
 124                         if (val == NULL)
 125                                 break;
 126
 127                         if (!radius_msg_add_attr(msg, RADIUS_ATTR_CLASS,
 128                                                  val, len)) {
 129                                 wpa_printf(MSG_INFO, "Could not add Class");
 130                                 goto fail;
 131                         }
 132                 }
 133
 134                 b = ieee802_1x_get_radius_cui(sta->eapol_sm);
 135                 if (b &&
 136                     !radius_msg_add_attr(msg,
 137                                          RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
 138                                          wpabuf_head(b), wpabuf_len(b))) {
 139                         wpa_printf(MSG_ERROR, "Could not add CUI");
 140                         goto fail;
 141                 }
 142
 143                 if (!b && sta->radius_cui &&
 144                     !radius_msg_add_attr(msg,
 145                                          RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
 146                                          (u8 *) sta->radius_cui,
 147                                          os_strlen(sta->radius_cui))) {
 148                         wpa_printf(MSG_ERROR, "Could not add CUI from ACL");
 149                         goto fail;
 150                 }
 151
 152                 if (sta->ipaddr &&
 153                     !radius_msg_add_attr_int32(msg,
 154                                                RADIUS_ATTR_FRAMED_IP_ADDRESS,
 155                                                be_to_host32(sta->ipaddr))) {
 156                         wpa_printf(MSG_ERROR,
 157                                    "Could not add Framed-IP-Address");
 158                         goto fail;
 159                 }
 160         }
 161
 162         return msg;
 163
 164  fail:
 165         radius_msg_free(msg);
 166         return NULL;
 167 }
 168
 169
 170 static int accounting_sta_update_stats(struct hostapd_data *hapd,
 171                                        struct sta_info *sta,
 172                                        struct hostap_sta_driver_data *data)
 173 {
 174         if (hostapd_drv_read_sta_data(hapd, data, sta->addr))
 175                 return -1;
 176
 177         if (sta->last_rx_bytes > data->rx_bytes)
 178                 sta->acct_input_gigawords++;
 179         if (sta->last_tx_bytes > data->tx_bytes)
 180                 sta->acct_output_gigawords++;
 181         sta->last_rx_bytes = data->rx_bytes;
 182         sta->last_tx_bytes = data->tx_bytes;
 183
 184         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
 185                        HOSTAPD_LEVEL_DEBUG, "updated TX/RX stats: "
 186                        "Acct-Input-Octets=%lu Acct-Input-Gigawords=%u "
 187                        "Acct-Output-Octets=%lu Acct-Output-Gigawords=%u",
 188                        sta->last_rx_bytes, sta->acct_input_gigawords,
 189                        sta->last_tx_bytes, sta->acct_output_gigawords);
 190
 191         return 0;
 192 }
 193
 194
 195 static void accounting_interim_update(void *eloop_ctx, void *timeout_ctx)
 196 {
 197         struct hostapd_data *hapd = eloop_ctx;
 198         struct sta_info *sta = timeout_ctx;
 199         int interval;
 200
 201         if (sta->acct_interim_interval) {
 202                 accounting_sta_interim(hapd, sta);
 203                 interval = sta->acct_interim_interval;
 204         } else {
 205                 struct hostap_sta_driver_data data;
 206                 accounting_sta_update_stats(hapd, sta, &data);
 207                 interval = ACCT_DEFAULT_UPDATE_INTERVAL;
 208         }
 209
 210         eloop_register_timeout(interval, 0, accounting_interim_update,
 211                                hapd, sta);
 212 }
 213
 214
 215 /**
 216  * accounting_sta_start - Start STA accounting
 217  * @hapd: hostapd BSS data
 218  * @sta: The station
 219  */
 220 void accounting_sta_start(struct hostapd_data *hapd, struct sta_info *sta)
 221 {
 222         struct radius_msg *msg;
 223         int interval;
 224
 225         if (sta->acct_session_started)
 226                 return;
 227
 228         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
 229                        HOSTAPD_LEVEL_INFO,
 230                        "starting accounting session %08X-%08X",
 231                        sta->acct_session_id_hi, sta->acct_session_id_lo);
 232
 233         os_get_reltime(&sta->acct_session_start);
 234         sta->last_rx_bytes = sta->last_tx_bytes = 0;
 235         sta->acct_input_gigawords = sta->acct_output_gigawords = 0;
 236         hostapd_drv_sta_clear_stats(hapd, sta->addr);
 237
 238         if (!hapd->conf->radius->acct_server)
 239                 return;
 240
 241         if (sta->acct_interim_interval)
 242                 interval = sta->acct_interim_interval;
 243         else
 244                 interval = ACCT_DEFAULT_UPDATE_INTERVAL;
 245         eloop_register_timeout(interval, 0, accounting_interim_update,
 246                                hapd, sta);
 247
 248         msg = accounting_msg(hapd, sta, RADIUS_ACCT_STATUS_TYPE_START);
 249         if (msg &&
 250             radius_client_send(hapd->radius, msg, RADIUS_ACCT, sta->addr) < 0)
 251                 radius_msg_free(msg);
 252
 253         sta->acct_session_started = 1;
 254 }
 255
 256
 257 static void accounting_sta_report(struct hostapd_data *hapd,
 258                                   struct sta_info *sta, int stop)
 259 {
 260         struct radius_msg *msg;
 261         int cause = sta->acct_terminate_cause;
 262         struct hostap_sta_driver_data data;
 263         struct os_reltime now_r, diff;
 264         struct os_time now;
 265         u32 gigawords;
 266
 267         if (!hapd->conf->radius->acct_server)
 268                 return;
 269
 270         msg = accounting_msg(hapd, sta,
 271                              stop ? RADIUS_ACCT_STATUS_TYPE_STOP :
 272                              RADIUS_ACCT_STATUS_TYPE_INTERIM_UPDATE);
 273         if (!msg) {
 274                 wpa_printf(MSG_INFO, "Could not create RADIUS Accounting message");
 275                 return;
 276         }
 277
 278         os_get_reltime(&now_r);
 279         os_get_time(&now);
 280         os_reltime_sub(&now_r, &sta->acct_session_start, &diff);
 281         if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_SESSION_TIME,
 282                                        diff.sec)) {
 283                 wpa_printf(MSG_INFO, "Could not add Acct-Session-Time");
 284                 goto fail;
 285         }
 286
 287         if (accounting_sta_update_stats(hapd, sta, &data) == 0) {
 288                 if (!radius_msg_add_attr_int32(msg,
 289                                                RADIUS_ATTR_ACCT_INPUT_PACKETS,
 290                                                data.rx_packets)) {
 291                         wpa_printf(MSG_INFO, "Could not add Acct-Input-Packets");
 292                         goto fail;
 293                 }
 294                 if (!radius_msg_add_attr_int32(msg,
 295                                                RADIUS_ATTR_ACCT_OUTPUT_PACKETS,
 296                                                data.tx_packets)) {
 297                         wpa_printf(MSG_INFO, "Could not add Acct-Output-Packets");
 298                         goto fail;
 299                 }
 300                 if (!radius_msg_add_attr_int32(msg,
 301                                                RADIUS_ATTR_ACCT_INPUT_OCTETS,
 302                                                data.rx_bytes)) {
 303                         wpa_printf(MSG_INFO, "Could not add Acct-Input-Octets");
 304                         goto fail;
 305                 }
 306                 gigawords = sta->acct_input_gigawords;
 307 #if __WORDSIZE == 64
 308                 gigawords += data.rx_bytes >> 32;
 309 #endif
 310                 if (gigawords &&
 311                     !radius_msg_add_attr_int32(
 312                             msg, RADIUS_ATTR_ACCT_INPUT_GIGAWORDS,
 313                             gigawords)) {
 314                         wpa_printf(MSG_INFO, "Could not add Acct-Input-Gigawords");
 315                         goto fail;
 316                 }
 317                 if (!radius_msg_add_attr_int32(msg,
 318                                                RADIUS_ATTR_ACCT_OUTPUT_OCTETS,
 319                                                data.tx_bytes)) {
 320                         wpa_printf(MSG_INFO, "Could not add Acct-Output-Octets");
 321                         goto fail;
 322                 }
 323                 gigawords = sta->acct_output_gigawords;
 324 #if __WORDSIZE == 64
 325                 gigawords += data.tx_bytes >> 32;
 326 #endif
 327                 if (gigawords &&
 328                     !radius_msg_add_attr_int32(
 329                             msg, RADIUS_ATTR_ACCT_OUTPUT_GIGAWORDS,
 330                             gigawords)) {
 331                         wpa_printf(MSG_INFO, "Could not add Acct-Output-Gigawords");
 332                         goto fail;
 333                 }
 334         }
 335
 336         if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_EVENT_TIMESTAMP,
 337                                        now.sec)) {
 338                 wpa_printf(MSG_INFO, "Could not add Event-Timestamp");
 339                 goto fail;
 340         }
 341
 342         if (eloop_terminated())
 343                 cause = RADIUS_ACCT_TERMINATE_CAUSE_ADMIN_REBOOT;
 344
 345         if (stop && cause &&
 346             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_TERMINATE_CAUSE,
 347                                        cause)) {
 348                 wpa_printf(MSG_INFO, "Could not add Acct-Terminate-Cause");
 349                 goto fail;
 350         }
 351
 352         if (radius_client_send(hapd->radius, msg,
 353                                stop ? RADIUS_ACCT : RADIUS_ACCT_INTERIM,
 354                                sta->addr) < 0)
 355                 goto fail;
 356         return;
 357
 358  fail:
 359         radius_msg_free(msg);
 360 }
 361
 362
 363 /**
 364  * accounting_sta_interim - Send a interim STA accounting report
 365  * @hapd: hostapd BSS data
 366  * @sta: The station
 367  */
 368 static void accounting_sta_interim(struct hostapd_data *hapd,
 369                                    struct sta_info *sta)
 370 {
 371         if (sta->acct_session_started)
 372                 accounting_sta_report(hapd, sta, 0);
 373 }
 374
 375
 376 /**
 377  * accounting_sta_stop - Stop STA accounting
 378  * @hapd: hostapd BSS data
 379  * @sta: The station
 380  */
 381 void accounting_sta_stop(struct hostapd_data *hapd, struct sta_info *sta)
 382 {
 383         if (sta->acct_session_started) {
 384                 accounting_sta_report(hapd, sta, 1);
 385                 eloop_cancel_timeout(accounting_interim_update, hapd, sta);
 386                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
 387                                HOSTAPD_LEVEL_INFO,
 388                                "stopped accounting session %08X-%08X",
 389                                sta->acct_session_id_hi,
 390                                sta->acct_session_id_lo);
 391                 sta->acct_session_started = 0;
 392         }
 393 }
 394
 395
 396 void accounting_sta_get_id(struct hostapd_data *hapd,
 397                                   struct sta_info *sta)
 398 {
 399         sta->acct_session_id_lo = hapd->acct_session_id_lo++;
 400         if (hapd->acct_session_id_lo == 0) {
 401                 hapd->acct_session_id_hi++;
 402         }
 403         sta->acct_session_id_hi = hapd->acct_session_id_hi;
 404 }
 405
 406
 407 /**
 408  * accounting_receive - Process the RADIUS frames from Accounting Server
 409  * @msg: RADIUS response message
 410  * @req: RADIUS request message
 411  * @shared_secret: RADIUS shared secret
 412  * @shared_secret_len: Length of shared_secret in octets
 413  * @data: Context data (struct hostapd_data *)
 414  * Returns: Processing status
 415  */
 416 static RadiusRxResult
 417 accounting_receive(struct radius_msg *msg, struct radius_msg *req,
 418                    const u8 *shared_secret, size_t shared_secret_len,
 419                    void *data)
 420 {
 421         if (radius_msg_get_hdr(msg)->code != RADIUS_CODE_ACCOUNTING_RESPONSE) {
 422                 wpa_printf(MSG_INFO, "Unknown RADIUS message code");
 423                 return RADIUS_RX_UNKNOWN;
 424         }
 425
 426         if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 0)) {
 427                 wpa_printf(MSG_INFO, "Incoming RADIUS packet did not have correct Authenticator - dropped");
 428                 return RADIUS_RX_INVALID_AUTHENTICATOR;
 429         }
 430
 431         return RADIUS_RX_PROCESSED;
 432 }
 433
 434
 435 static void accounting_report_state(struct hostapd_data *hapd, int on)
 436 {
 437         struct radius_msg *msg;
 438
 439         if (!hapd->conf->radius->acct_server || hapd->radius == NULL)
 440                 return;
 441
 442         /* Inform RADIUS server that accounting will start/stop so that the
 443          * server can close old accounting sessions. */
 444         msg = accounting_msg(hapd, NULL,
 445                              on ? RADIUS_ACCT_STATUS_TYPE_ACCOUNTING_ON :
 446                              RADIUS_ACCT_STATUS_TYPE_ACCOUNTING_OFF);
 447         if (!msg)
 448                 return;
 449
 450         if (radius_client_send(hapd->radius, msg, RADIUS_ACCT, NULL) < 0)
 451                 radius_msg_free(msg);
 452 }
 453
 454
 455 /**
 456  * accounting_init: Initialize accounting
 457  * @hapd: hostapd BSS data
 458  * Returns: 0 on success, -1 on failure
 459  */
 460 int accounting_init(struct hostapd_data *hapd)
 461 {
 462         struct os_time now;
 463
 464         /* Acct-Session-Id should be unique over reboots. Using a random number
 465          * is preferred. If that is not available, take the current time. Mix
 466          * in microseconds to make this more likely to be unique. */
 467         os_get_time(&now);
 468         if (os_get_random((u8 *) &hapd->acct_session_id_hi,
 469                           sizeof(hapd->acct_session_id_hi)) < 0)
 470                 hapd->acct_session_id_hi = now.sec;
 471         hapd->acct_session_id_hi ^= now.usec;
 472
 473         if (radius_client_register(hapd->radius, RADIUS_ACCT,
 474                                    accounting_receive, hapd))
 475                 return -1;
 476
 477         accounting_report_state(hapd, 1);
 478
 479         return 0;
 480 }
 481
 482
 483 /**
 484  * accounting_deinit: Deinitialize accounting
 485  * @hapd: hostapd BSS data
 486  */
 487 void accounting_deinit(struct hostapd_data *hapd)
 488 {
 489         accounting_report_state(hapd, 0);
 490 }