-return NULL;
-}
-//-----------------------------------------------------------------------------
-int RADIUS::RecvData(RAD_PACKET * packet)
-{
- int8_t buf[RAD_MAX_PACKET_LEN];
- outerAddrLen = sizeof(struct sockaddr_in);
- int dataLen = recvfrom(sock, buf, RAD_MAX_PACKET_LEN, 0, (struct sockaddr *)&outerAddr, &outerAddrLen);
- if (dataLen > 0) {
- Decrypt(&ctx, (char *)packet, (const char *)buf, dataLen / 8);
- }
- if (strncmp((char *)packet->magic, RAD_ID, RAD_MAGIC_LEN))
- {
- printfd(__FILE__, "RADIUS::RecvData Error magic. Wanted: '%s', got: '%s'\n", RAD_ID, packet->magic);
- return -1;
- }
- return 0;
-}
-//-----------------------------------------------------------------------------
-int RADIUS::Send(const RAD_PACKET & packet)
-{
-int res, len = sizeof(RAD_PACKET);
-char buf[1032];
-
-Encrypt(&ctx, buf, (char *)&packet, len / 8);
-res = sendto(sock, buf, len, 0, (struct sockaddr *)&outerAddr, outerAddrLen);
-
-return 0;
-}
-//-----------------------------------------------------------------------------
-int RADIUS::ProcessData(RAD_PACKET * packet)
-{
-//struct in_addr addr = {packet->ip};
-if (strncmp((const char *)packet->protoVer, "01", 2))
- {
- printfd(__FILE__, "RADIUS::ProcessData packet.protoVer incorrect\n");
- return -1;
- }
-switch (packet->packetType)
- {
- case RAD_AUTZ_PACKET:
- return ProcessAutzPacket(packet);
- case RAD_AUTH_PACKET:
- return ProcessAuthPacket(packet);
- case RAD_POST_AUTH_PACKET:
- return ProcessPostAuthPacket(packet);
- case RAD_ACCT_START_PACKET:
- return ProcessAcctStartPacket(packet);
- case RAD_ACCT_STOP_PACKET:
- return ProcessAcctStopPacket(packet);
- case RAD_ACCT_UPDATE_PACKET:
- return ProcessAcctUpdatePacket(packet);
- case RAD_ACCT_OTHER_PACKET:
- return ProcessAcctOtherPacket(packet);
- default:
- printfd(__FILE__, "RADIUS::ProcessData Unsupported packet type: %d\n", packet->packetType);
- return -1;
- };
-return 0;
-}
-//-----------------------------------------------------------------------------
-int RADIUS::ProcessAutzPacket(RAD_PACKET * packet)
-{
-USER_CONF conf;
-
-if (!IsAllowedService((char *)packet->service))
- {
- printfd(__FILE__, "RADIUS::ProcessAutzPacket service '%s' is not allowed to authorize\n", packet->service);
- packet->packetType = RAD_REJECT_PACKET;
- return 0;
- }
-
-if (store->RestoreUserConf(&conf, (char *)packet->login))
- {
- packet->packetType = RAD_REJECT_PACKET;
- printfd(__FILE__, "RADIUS::ProcessAutzPacket cannot restore conf for user '%s'\n", packet->login);
- return 0;
- }
-
-// At this point service can be authorized at least
-// So we send a plain-text password
-
-packet->packetType = RAD_ACCEPT_PACKET;
-strncpy((char *)packet->password, conf.password.c_str(), RAD_PASSWORD_LEN);
-
-return 0;
-}
-//-----------------------------------------------------------------------------
-int RADIUS::ProcessAuthPacket(RAD_PACKET * packet)
-{
-user_iter ui;
-
-if (!CanAcctService((char *)packet->service))
- {
-
- // There are no sense to check for allowed service
- // It has allready checked at previous stage (authorization)
-
- printfd(__FILE__, "RADIUS::ProcessAuthPacket service '%s' neednot stargazer authentication\n", (char *)packet->service);
- packet->packetType = RAD_ACCEPT_PACKET;
- return 0;
- }
-
-// At this point we have an accountable service
-// All other services got a password if allowed or rejected
-
-if (!FindUser(&ui, (char *)packet->login))
- {
- packet->packetType = RAD_REJECT_PACKET;
- printfd(__FILE__, "RADIUS::ProcessAuthPacket user '%s' not found\n", (char *)packet->login);
- return 0;
- }
-
-if (ui->IsInetable())
- {
- packet->packetType = RAD_ACCEPT_PACKET;
- }
-else
- {
- packet->packetType = RAD_REJECT_PACKET;
- }
-
-packet->packetType = RAD_ACCEPT_PACKET;
-return 0;
-}
-//-----------------------------------------------------------------------------
-int RADIUS::ProcessPostAuthPacket(RAD_PACKET * packet)
-{
-user_iter ui;
-
-if (!CanAcctService((char *)packet->service))
- {
-
- // There are no sense to check for allowed service
- // It has allready checked at previous stage (authorization)
-
- packet->packetType = RAD_ACCEPT_PACKET;
- return 0;
- }
-
-if (!FindUser(&ui, (char *)packet->login))
- {
- packet->packetType = RAD_REJECT_PACKET;
- printfd(__FILE__, "RADIUS::ProcessPostAuthPacket user '%s' not found\n", (char *)packet->login);
- return 0;
- }
-
-// I think that only Framed-User services has sense to be accountable
-// So we have to supply a Framed-IP
-
-USER_IPS ips = ui->property.ips;
-packet->packetType = RAD_ACCEPT_PACKET;
-
-// Additional checking for Framed-User service
-
-if (!strncmp((char *)packet->service, "Framed-User", RAD_SERVICE_LEN))
- packet->ip = ips[0].ip;
-else
- packet->ip = 0;
-
-return 0;
-}
-//-----------------------------------------------------------------------------
-int RADIUS::ProcessAcctStartPacket(RAD_PACKET * packet)
-{
-user_iter ui;
-
-if (!FindUser(&ui, (char *)packet->login))
- {
- packet->packetType = RAD_REJECT_PACKET;
- printfd(__FILE__, "RADIUS::ProcessAcctStartPacket user '%s' not found\n", (char *)packet->login);
- return 0;
- }
-
-// At this point we have to unauthorize user only if it is an accountable service
-
-if (CanAcctService((char *)packet->service))
- {
- if (sessions.find((const char *)packet->sessid) != sessions.end())
- {
- printfd(__FILE__, "RADIUS::ProcessAcctStartPacket session already started!\n");
- packet->packetType = RAD_REJECT_PACKET;
- return -1;
- }
- USER_IPS ips = ui->property.ips;
- if (ui->Authorize(ips[0].ip, "", 0xffFFffFF, this))
- {
- printfd(__FILE__, "RADIUS::ProcessAcctStartPacket cannot authorize user '%s'\n", packet->login);
- packet->packetType = RAD_REJECT_PACKET;
- return -1;
- }
- sessions[(const char *)packet->sessid].userName = (const char *)packet->login;
- sessions[(const char *)packet->sessid].serviceType = (const char *)packet->service;
- for_each(sessions.begin(), sessions.end(), SPrinter());
- }
-else
- {
- printfd(__FILE__, "RADIUS::ProcessAcctStartPacket service '%s' can not be accounted\n", (char *)packet->service);
- }
-
-packet->packetType = RAD_ACCEPT_PACKET;
-return 0;
-}
-//-----------------------------------------------------------------------------
-int RADIUS::ProcessAcctStopPacket(RAD_PACKET * packet)
-{
-map<string, RAD_SESSION>::iterator sid;
-
-if ((sid = sessions.find((const char *)packet->sessid)) == sessions.end())
- {
- printfd(__FILE__, "RADIUS::ProcessAcctStopPacket session had not started yet\n");
- packet->packetType = RAD_REJECT_PACKET;
- return -1;
- }
-
-user_iter ui;
-
-if (!FindUser(&ui, sid->second.userName))
- {
- packet->packetType = RAD_REJECT_PACKET;
- printfd(__FILE__, "RADIUS::ProcessPostAuthPacket user '%s' not found\n", sid->second.userName.c_str());
- return 0;
- }
-
-sessions.erase(sid);
-
-ui->Unauthorize(this);
-
-packet->packetType = RAD_ACCEPT_PACKET;
-return 0;
-}
-//-----------------------------------------------------------------------------
-int RADIUS::ProcessAcctUpdatePacket(RAD_PACKET * packet)
-{
-// Fake. May be used later
-packet->packetType = RAD_ACCEPT_PACKET;
-return 0;
-}
-//-----------------------------------------------------------------------------
-int RADIUS::ProcessAcctOtherPacket(RAD_PACKET * packet)
-{
-// Fake. May be used later
-packet->packetType = RAD_ACCEPT_PACKET;
-return 0;
-}
-//-----------------------------------------------------------------------------
-void RADIUS::InitEncrypt(BLOWFISH_CTX * ctx, const string & password)
-{
-unsigned char keyL[RAD_PASSWORD_LEN]; // Пароль для шифровки
-memset(keyL, 0, RAD_PASSWORD_LEN);
-strncpy((char *)keyL, password.c_str(), RAD_PASSWORD_LEN);
-Blowfish_Init(ctx, keyL, RAD_PASSWORD_LEN);
-}
-//-----------------------------------------------------------------------------
-void RADIUS::Encrypt(BLOWFISH_CTX * ctx, char * dst, const char * src, int len8)
-{
-// len8 - длина в 8-ми байтовых блоках
-if (dst != src)
- memcpy(dst, src, len8 * 8);
-
-for (int i = 0; i < len8; i++)
- Blowfish_Encrypt(ctx, (uint32_t *)(dst + i*8), (uint32_t *)(dst + i*8 + 4));
-}
-//-----------------------------------------------------------------------------
-void RADIUS::Decrypt(BLOWFISH_CTX * ctx, char * dst, const char * src, int len8)
-{
-// len8 - длина в 8-ми байтовых блоках
-if (dst != src)
- memcpy(dst, src, len8 * 8);
-
-for (int i = 0; i < len8; i++)
- Blowfish_Decrypt(ctx, (uint32_t *)(dst + i*8), (uint32_t *)(dst + i*8 + 4));
-}
-//-----------------------------------------------------------------------------
-void RADIUS::PrintServices(const list<string> & svcs)
-{
- for_each(svcs.begin(), svcs.end(), Printer());
-}
-//-----------------------------------------------------------------------------
-bool RADIUS::FindUser(user_iter * ui, const std::string & login) const
-{
-if (users->FindByName(login, ui))
- {
- return false;
- }
-return true;
-}
-//-----------------------------------------------------------------------------
-bool RADIUS::CanAuthService(const std::string & svc) const
-{
- return find(authServices.begin(), authServices.end(), svc) != authServices.end();
-}
-//-----------------------------------------------------------------------------
-bool RADIUS::CanAcctService(const std::string & svc) const
-{
- return find(acctServices.begin(), acctServices.end(), svc) != acctServices.end();
-}
-//-----------------------------------------------------------------------------
-bool RADIUS::IsAllowedService(const std::string & svc) const
git.stg.codes / stg.git / blobdiff