X-Git-Url: https://git.stg.codes/stg.git/blobdiff_plain/641204dfbdb9fc870cdd2e7f9e3169a44693e7bf..a9f633a23d4fdd32c3185d13f8987a8ff7a8f82d:/projects/stargazer/plugins/other/radius/radius.cpp?ds=sidebyside diff --git a/projects/stargazer/plugins/other/radius/radius.cpp b/projects/stargazer/plugins/other/radius/radius.cpp index 591f4b63..18c18816 100644 --- a/projects/stargazer/plugins/other/radius/radius.cpp +++ b/projects/stargazer/plugins/other/radius/radius.cpp @@ -26,120 +26,57 @@ * */ +#include +#include #include -#include +#include "stg/store.h" +#include "stg/common.h" +#include "stg/user_conf.h" +#include "stg/user_property.h" +#include "stg/plugin_creator.h" #include "radius.h" -#include "common.h" extern volatile const time_t stgTime; -//----------------------------------------------------------------------------- -//----------------------------------------------------------------------------- -//----------------------------------------------------------------------------- -class RAD_CREATOR -{ -private: - RADIUS * rad; - -public: - RAD_CREATOR() - : rad(new RADIUS()) - { - }; - ~RAD_CREATOR() - { - delete rad; - }; +void InitEncrypt(BLOWFISH_CTX * ctx, const std::string & password); +void Decrypt(BLOWFISH_CTX * ctx, char * dst, const char * src, int len8); +void Encrypt(BLOWFISH_CTX * ctx, char * dst, const char * src, int len8); - RADIUS * GetPlugin() - { - return rad; - }; -}; //----------------------------------------------------------------------------- //----------------------------------------------------------------------------- //----------------------------------------------------------------------------- -RAD_CREATOR radc; +PLUGIN_CREATOR radc; //----------------------------------------------------------------------------- //----------------------------------------------------------------------------- //----------------------------------------------------------------------------- -BASE_PLUGIN * GetPlugin() +PLUGIN * GetPlugin() { return radc.GetPlugin(); } //----------------------------------------------------------------------------- //----------------------------------------------------------------------------- //----------------------------------------------------------------------------- -uint16_t RAD_SETTINGS::GetPort() const -{ -return port; -} -//----------------------------------------------------------------------------- -uint32_t RAD_SETTINGS::GetServerIP() const -{ -return serverIP; -} -//----------------------------------------------------------------------------- -int RAD_SETTINGS::GetPassword(string * password) const -{ -*password = RAD_SETTINGS::password; -return 0; -} -//----------------------------------------------------------------------------- -int RAD_SETTINGS::GetAuthServices(list * svcs) const -{ -*svcs = authServices; -return 0; -} -//----------------------------------------------------------------------------- -int RAD_SETTINGS::GetAcctServices(list * svcs) const -{ -*svcs = acctServices; -return 0; -} -//----------------------------------------------------------------------------- -int RAD_SETTINGS::ParseIP(const string & str, uint32_t * IP) -{ -*IP = inet_addr(str.c_str()); -return *IP == INADDR_NONE ? -1 : 0; -} -//----------------------------------------------------------------------------- -int RAD_SETTINGS::ParseIntInRange(const string & str, int min, int max, int * val) -{ -if (str2x(str.c_str(), *val)) - { - errorStr = "Incorrect value \'" + str + "\'."; - return -1; - } -if (*val < min || *val > max) - { - errorStr = "Value \'" + str + "\' out of range."; - return -1; - } -return 0; -} -//----------------------------------------------------------------------------- -int RAD_SETTINGS::ParseServices(const vector & str, list * lst) +int RAD_SETTINGS::ParseServices(const std::vector & str, std::list * lst) { - copy(str.begin(), str.end(), back_inserter(*lst)); - list::iterator it(find(lst->begin(), - lst->end(), - "empty")); - if (it != lst->end()) - *it = ""; +std::copy(str.begin(), str.end(), std::back_inserter(*lst)); +std::list::iterator it(std::find(lst->begin(), + lst->end(), + "empty")); +if (it != lst->end()) + *it = ""; - return 0; +return 0; } //----------------------------------------------------------------------------- int RAD_SETTINGS::ParseSettings(const MODULE_SETTINGS & s) { int p; PARAM_VALUE pv; -vector::const_iterator pvi; +std::vector::const_iterator pvi; /////////////////////////// pv.param = "Port"; -pvi = find(s.moduleParams.begin(), s.moduleParams.end(), pv); +pvi = std::find(s.moduleParams.begin(), s.moduleParams.end(), pv); if (pvi == s.moduleParams.end()) { errorStr = "Parameter \'Port\' not found."; @@ -154,22 +91,8 @@ if (ParseIntInRange(pvi->value[0], 2, 65535, &p)) } port = p; /////////////////////////// -pv.param = "ServerIP"; -pvi = find(s.moduleParams.begin(), s.moduleParams.end(), pv); -if (pvi == s.moduleParams.end()) - { - serverIP = 0; - } -else - { - if (ParseIP(pvi->value[0], &serverIP)) - { - serverIP = 0; - } - } -/////////////////////////// pv.param = "Password"; -pvi = find(s.moduleParams.begin(), s.moduleParams.end(), pv); +pvi = std::find(s.moduleParams.begin(), s.moduleParams.end(), pv); if (pvi == s.moduleParams.end()) { errorStr = "Parameter \'Password\' not found."; @@ -179,14 +102,14 @@ if (pvi == s.moduleParams.end()) password = pvi->value[0]; /////////////////////////// pv.param = "AuthServices"; -pvi = find(s.moduleParams.begin(), s.moduleParams.end(), pv); +pvi = std::find(s.moduleParams.begin(), s.moduleParams.end(), pv); if (pvi != s.moduleParams.end()) { ParseServices(pvi->value, &authServices); } /////////////////////////// pv.param = "AcctServices"; -pvi = find(s.moduleParams.begin(), s.moduleParams.end(), pv); +pvi = std::find(s.moduleParams.begin(), s.moduleParams.end(), pv); if (pvi != s.moduleParams.end()) { ParseServices(pvi->value, &acctServices); @@ -198,28 +121,24 @@ return 0; //----------------------------------------------------------------------------- //----------------------------------------------------------------------------- RADIUS::RADIUS() -{ -isRunning = false; -} -//----------------------------------------------------------------------------- -void RADIUS::SetUsers(USERS * u) -{ -users = u; -} -//----------------------------------------------------------------------------- -void RADIUS::SetStgSettings(const SETTINGS * s) -{ -stgSettings = s; -} -//----------------------------------------------------------------------------- -void RADIUS::SetSettings(const MODULE_SETTINGS & s) -{ -settings = s; -} -//----------------------------------------------------------------------------- -void RADIUS::SetStore(BASE_STORE * s) -{ -store = s; + : ctx(), + errorStr(), + radSettings(), + settings(), + authServices(), + acctServices(), + sessions(), + nonstop(false), + isRunning(false), + users(NULL), + stgSettings(NULL), + store(NULL), + thread(), + mutex(), + sock(-1), + packet() +{ +InitEncrypt(&ctx, ""); } //----------------------------------------------------------------------------- int RADIUS::ParseSettings() @@ -230,35 +149,6 @@ if (ret) return ret; } //----------------------------------------------------------------------------- -bool RADIUS::IsRunning() -{ -return isRunning; -} -//----------------------------------------------------------------------------- -const string RADIUS::GetVersion() const -{ -return "RADIUS data access plugin v 0.6"; -} -//----------------------------------------------------------------------------- -uint16_t RADIUS::GetStartPosition() const -{ -// Start before any authorizers!!! -return 20; -} -//----------------------------------------------------------------------------- -uint16_t RADIUS::GetStopPosition() const -{ -return 20; -} -//----------------------------------------------------------------------------- -void RADIUS::SetUserNotifier(user_iter) -{ -} -//----------------------------------------------------------------------------- -void RADIUS::UnSetUserNotifier(user_iter) -{ -} -//----------------------------------------------------------------------------- int RADIUS::PrepareNet() { sock = socket(AF_INET, SOCK_DGRAM, 0); @@ -270,8 +160,9 @@ if (sock < 0) return -1; } +struct sockaddr_in inAddr; inAddr.sin_family = AF_INET; -inAddr.sin_port = htons(port); +inAddr.sin_port = htons(radSettings.GetPort()); inAddr.sin_addr.s_addr = inet_addr("0.0.0.0"); if (bind(sock, (struct sockaddr*)&inAddr, sizeof(inAddr)) < 0) @@ -292,13 +183,10 @@ return 0; //----------------------------------------------------------------------------- int RADIUS::Start() { -string password; +std::string password(radSettings.GetPassword()); -radSettings.GetPassword(&password); -port = radSettings.GetPort(); -serverIP = radSettings.GetServerIP(); -radSettings.GetAuthServices(&authServices); -radSettings.GetAcctServices(&acctServices); +authServices = radSettings.GetAuthServices(); +acctServices = radSettings.GetAcctServices(); InitEncrypt(&ctx, password); @@ -330,13 +218,13 @@ if (!IsRunning()) nonstop = false; -map::iterator it; +std::map::iterator it; for (it = sessions.begin(); it != sessions.end(); ++it) { - user_iter ui; + USER_PTR ui; if (users->FindByName(it->second.userName, &ui)) { - ui->Unauthorize(this); + users->Unauthorize(ui->GetLogin(), this); } } sessions.erase(sessions.begin(), sessions.end()); @@ -348,27 +236,23 @@ if (isRunning) //5 seconds to thread stops itself for (int i = 0; i < 25 && isRunning; i++) { - usleep(200000); - } - - //after 5 seconds waiting thread still running. now killing it - if (isRunning) - { - if (pthread_kill(thread, SIGINT)) - { - errorStr = "Cannot kill thread."; - printfd(__FILE__, "Cannot kill thread\n"); - return -1; - } - printfd(__FILE__, "RADIUS::Stop killed Run\n"); + struct timespec ts = {0, 200000000}; + nanosleep(&ts, NULL); } } +if (isRunning) + return -1; + return 0; } //----------------------------------------------------------------------------- void * RADIUS::Run(void * d) { +sigset_t signalSet; +sigfillset(&signalSet); +pthread_sigmask(SIG_BLOCK, &signalSet, NULL); + RADIUS * rad = (RADIUS *)d; RAD_PACKET packet; @@ -376,11 +260,12 @@ rad->isRunning = true; while (rad->nonstop) { - if (!rad->WaitPackets(rad->sock)) + if (!WaitPackets(rad->sock)) { continue; } - if (rad->RecvData(&packet)) + struct sockaddr_in outerAddr; + if (rad->RecvData(&packet, &outerAddr)) { printfd(__FILE__, "RADIUS::Run Error on RecvData\n"); } @@ -390,7 +275,7 @@ while (rad->nonstop) { packet.packetType = RAD_REJECT_PACKET; } - rad->Send(packet); + rad->Send(packet, &outerAddr); } } @@ -399,11 +284,11 @@ rad->isRunning = false; return NULL; } //----------------------------------------------------------------------------- -int RADIUS::RecvData(RAD_PACKET * packet) +int RADIUS::RecvData(RAD_PACKET * packet, struct sockaddr_in * outerAddr) { int8_t buf[RAD_MAX_PACKET_LEN]; - outerAddrLen = sizeof(struct sockaddr_in); - int dataLen = recvfrom(sock, buf, RAD_MAX_PACKET_LEN, 0, (struct sockaddr *)&outerAddr, &outerAddrLen); + socklen_t outerAddrLen = sizeof(struct sockaddr_in); + int dataLen = recvfrom(sock, buf, RAD_MAX_PACKET_LEN, 0, reinterpret_cast(outerAddr), &outerAddrLen); if (dataLen > 0) { Decrypt(&ctx, (char *)packet, (const char *)buf, dataLen / 8); } @@ -415,20 +300,17 @@ int RADIUS::RecvData(RAD_PACKET * packet) return 0; } //----------------------------------------------------------------------------- -int RADIUS::Send(const RAD_PACKET & packet) +int RADIUS::Send(const RAD_PACKET & packet, struct sockaddr_in * outerAddr) { -int res, len = sizeof(RAD_PACKET); +size_t len = sizeof(RAD_PACKET); char buf[1032]; Encrypt(&ctx, buf, (char *)&packet, len / 8); -res = sendto(sock, buf, len, 0, (struct sockaddr *)&outerAddr, outerAddrLen); - -return 0; +return sendto(sock, buf, len, 0, reinterpret_cast(outerAddr), sizeof(struct sockaddr_in)); } //----------------------------------------------------------------------------- int RADIUS::ProcessData(RAD_PACKET * packet) { -//struct in_addr addr = {packet->ip}; if (strncmp((const char *)packet->protoVer, "01", 2)) { printfd(__FILE__, "RADIUS::ProcessData packet.protoVer incorrect\n"); @@ -486,7 +368,7 @@ return 0; //----------------------------------------------------------------------------- int RADIUS::ProcessAuthPacket(RAD_PACKET * packet) { -user_iter ui; +USER_PTR ui; if (!CanAcctService((char *)packet->service)) { @@ -524,7 +406,7 @@ return 0; //----------------------------------------------------------------------------- int RADIUS::ProcessPostAuthPacket(RAD_PACKET * packet) { -user_iter ui; +USER_PTR ui; if (!CanAcctService((char *)packet->service)) { @@ -546,7 +428,7 @@ if (!FindUser(&ui, (char *)packet->login)) // I think that only Framed-User services has sense to be accountable // So we have to supply a Framed-IP -USER_IPS ips = ui->property.ips; +USER_IPS ips = ui->GetProperty().ips; packet->packetType = RAD_ACCEPT_PACKET; // Additional checking for Framed-User service @@ -561,7 +443,7 @@ return 0; //----------------------------------------------------------------------------- int RADIUS::ProcessAcctStartPacket(RAD_PACKET * packet) { -user_iter ui; +USER_PTR ui; if (!FindUser(&ui, (char *)packet->login)) { @@ -580,8 +462,8 @@ if (CanAcctService((char *)packet->service)) packet->packetType = RAD_REJECT_PACKET; return -1; } - USER_IPS ips = ui->property.ips; - if (ui->Authorize(ips[0].ip, "", 0xffFFffFF, this)) + USER_IPS ips = ui->GetProperty().ips; + if (users->Authorize(ui->GetLogin(), ips[0].ip, 0xffFFffFF, this)) { printfd(__FILE__, "RADIUS::ProcessAcctStartPacket cannot authorize user '%s'\n", packet->login); packet->packetType = RAD_REJECT_PACKET; @@ -602,7 +484,7 @@ return 0; //----------------------------------------------------------------------------- int RADIUS::ProcessAcctStopPacket(RAD_PACKET * packet) { -map::iterator sid; +std::map::iterator sid; if ((sid = sessions.find((const char *)packet->sessid)) == sessions.end()) { @@ -611,7 +493,7 @@ if ((sid = sessions.find((const char *)packet->sessid)) == sessions.end()) return -1; } -user_iter ui; +USER_PTR ui; if (!FindUser(&ui, sid->second.userName)) { @@ -622,7 +504,7 @@ if (!FindUser(&ui, sid->second.userName)) sessions.erase(sid); -ui->Unauthorize(this); +users->Unauthorize(ui->GetLogin(), this); packet->packetType = RAD_ACCEPT_PACKET; return 0; @@ -630,52 +512,24 @@ return 0; //----------------------------------------------------------------------------- int RADIUS::ProcessAcctUpdatePacket(RAD_PACKET * packet) { -// Fake. May be used later +// Fake. May be use it later packet->packetType = RAD_ACCEPT_PACKET; return 0; } //----------------------------------------------------------------------------- int RADIUS::ProcessAcctOtherPacket(RAD_PACKET * packet) { -// Fake. May be used later +// Fake. May be use it later packet->packetType = RAD_ACCEPT_PACKET; return 0; } //----------------------------------------------------------------------------- -void RADIUS::InitEncrypt(BLOWFISH_CTX * ctx, const string & password) -{ -unsigned char keyL[RAD_PASSWORD_LEN]; // Пароль для шифровки -memset(keyL, 0, RAD_PASSWORD_LEN); -strncpy((char *)keyL, password.c_str(), RAD_PASSWORD_LEN); -Blowfish_Init(ctx, keyL, RAD_PASSWORD_LEN); -} -//----------------------------------------------------------------------------- -void RADIUS::Encrypt(BLOWFISH_CTX * ctx, char * dst, const char * src, int len8) -{ -// len8 - длина в 8-ми байтовых блоках -if (dst != src) - memcpy(dst, src, len8 * 8); - -for (int i = 0; i < len8; i++) - Blowfish_Encrypt(ctx, (uint32_t *)(dst + i*8), (uint32_t *)(dst + i*8 + 4)); -} -//----------------------------------------------------------------------------- -void RADIUS::Decrypt(BLOWFISH_CTX * ctx, char * dst, const char * src, int len8) -{ -// len8 - длина в 8-ми байтовых блоках -if (dst != src) - memcpy(dst, src, len8 * 8); - -for (int i = 0; i < len8; i++) - Blowfish_Decrypt(ctx, (uint32_t *)(dst + i*8), (uint32_t *)(dst + i*8 + 4)); -} -//----------------------------------------------------------------------------- -void RADIUS::PrintServices(const list & svcs) +void RADIUS::PrintServices(const std::list & svcs) { - for_each(svcs.begin(), svcs.end(), Printer()); +for_each(svcs.begin(), svcs.end(), Printer()); } //----------------------------------------------------------------------------- -bool RADIUS::FindUser(user_iter * ui, const std::string & login) const +bool RADIUS::FindUser(USER_PTR * ui, const std::string & login) const { if (users->FindByName(login, ui)) { @@ -686,43 +540,46 @@ return true; //----------------------------------------------------------------------------- bool RADIUS::CanAuthService(const std::string & svc) const { - return find(authServices.begin(), authServices.end(), svc) != authServices.end(); +return find(authServices.begin(), authServices.end(), svc) != authServices.end(); } //----------------------------------------------------------------------------- bool RADIUS::CanAcctService(const std::string & svc) const { - return find(acctServices.begin(), acctServices.end(), svc) != acctServices.end(); +return find(acctServices.begin(), acctServices.end(), svc) != acctServices.end(); } //----------------------------------------------------------------------------- bool RADIUS::IsAllowedService(const std::string & svc) const { - return CanAuthService(svc) || CanAcctService(svc); +return CanAuthService(svc) || CanAcctService(svc); } //----------------------------------------------------------------------------- -bool RADIUS::WaitPackets(int sd) const +inline +void InitEncrypt(BLOWFISH_CTX * ctx, const std::string & password) { -fd_set rfds; -FD_ZERO(&rfds); -FD_SET(sd, &rfds); - -struct timeval tv; -tv.tv_sec = 0; -tv.tv_usec = 500000; - -int res = select(sd + 1, &rfds, NULL, NULL, &tv); -if (res == -1) // Error - { - if (errno != EINTR) - { - printfd(__FILE__, "Error on select: '%s'\n", strerror(errno)); - } - return false; - } +unsigned char keyL[RAD_PASSWORD_LEN]; // Пароль для шифровки +memset(keyL, 0, RAD_PASSWORD_LEN); +strncpy((char *)keyL, password.c_str(), RAD_PASSWORD_LEN); +Blowfish_Init(ctx, keyL, RAD_PASSWORD_LEN); +} +//----------------------------------------------------------------------------- +inline +void Encrypt(BLOWFISH_CTX * ctx, char * dst, const char * src, int len8) +{ +// len8 - длина в 8-ми байтовых блоках +if (dst != src) + memcpy(dst, src, len8 * 8); -if (res == 0) // Timeout - { - return false; - } +for (int i = 0; i < len8; i++) + Blowfish_Encrypt(ctx, (uint32_t *)(dst + i*8), (uint32_t *)(dst + i*8 + 4)); +} +//----------------------------------------------------------------------------- +inline +void Decrypt(BLOWFISH_CTX * ctx, char * dst, const char * src, int len8) +{ +// len8 - длина в 8-ми байтовых блоках +if (dst != src) + memcpy(dst, src, len8 * 8); -return true; +for (int i = 0; i < len8; i++) + Blowfish_Decrypt(ctx, (uint32_t *)(dst + i*8), (uint32_t *)(dst + i*8 + 4)); }