src/ap/accounting.c

   1 /*
   2  * hostapd / RADIUS Accounting
   3  * Copyright (c) 2002-2009, 2012, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #include "utils/common.h"
  12 #include "utils/eloop.h"
  13 #include "drivers/driver.h"
  14 #include "radius/radius.h"
  15 #include "radius/radius_client.h"
  16 #include "hostapd.h"
  17 #include "ieee802_1x.h"
  18 #include "ap_config.h"
  19 #include "sta_info.h"
  20 #include "ap_drv_ops.h"
  21 #include "accounting.h"
  22
  23
  24 /* Default interval in seconds for polling TX/RX octets from the driver if
  25  * STA is not using interim accounting. This detects wrap arounds for
  26  * input/output octets and updates Acct-{Input,Output}-Gigawords. */
  27 #define ACCT_DEFAULT_UPDATE_INTERVAL 300
  28
  29 static void accounting_sta_get_id(struct hostapd_data *hapd,
  30                                   struct sta_info *sta);
  31
  32
  33 static struct radius_msg * accounting_msg(struct hostapd_data *hapd,
  34                                           struct sta_info *sta,
  35                                           int status_type)
  36 {
  37         struct radius_msg *msg;
  38         char buf[128];
  39         u8 *val;
  40         size_t len;
  41         int i;
  42         struct wpabuf *b;
  43         struct hostapd_radius_attr *attr;
  44
  45         msg = radius_msg_new(RADIUS_CODE_ACCOUNTING_REQUEST,
  46                              radius_client_get_id(hapd->radius));
  47         if (msg == NULL) {
  48                 printf("Could not create net RADIUS packet\n");
  49                 return NULL;
  50         }
  51
  52         if (sta) {
  53                 radius_msg_make_authenticator(msg, (u8 *) sta, sizeof(*sta));
  54
  55                 os_snprintf(buf, sizeof(buf), "%08X-%08X",
  56                             sta->acct_session_id_hi, sta->acct_session_id_lo);
  57                 if (!radius_msg_add_attr(msg, RADIUS_ATTR_ACCT_SESSION_ID,
  58                                          (u8 *) buf, os_strlen(buf))) {
  59                         printf("Could not add Acct-Session-Id\n");
  60                         goto fail;
  61                 }
  62         } else {
  63                 radius_msg_make_authenticator(msg, (u8 *) hapd, sizeof(*hapd));
  64         }
  65
  66         if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_STATUS_TYPE,
  67                                        status_type)) {
  68                 printf("Could not add Acct-Status-Type\n");
  69                 goto fail;
  70         }
  71
  72         if (!hostapd_config_get_radius_attr(hapd->conf->radius_acct_req_attr,
  73                                             RADIUS_ATTR_ACCT_AUTHENTIC) &&
  74             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_AUTHENTIC,
  75                                        hapd->conf->ieee802_1x ?
  76                                        RADIUS_ACCT_AUTHENTIC_RADIUS :
  77                                        RADIUS_ACCT_AUTHENTIC_LOCAL)) {
  78                 printf("Could not add Acct-Authentic\n");
  79                 goto fail;
  80         }
  81
  82         if (sta) {
  83                 val = ieee802_1x_get_identity(sta->eapol_sm, &len);
  84                 if (!val) {
  85                         os_snprintf(buf, sizeof(buf), RADIUS_ADDR_FORMAT,
  86                                     MAC2STR(sta->addr));
  87                         val = (u8 *) buf;
  88                         len = os_strlen(buf);
  89                 }
  90
  91                 if (!radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME, val,
  92                                          len)) {
  93                         printf("Could not add User-Name\n");
  94                         goto fail;
  95                 }
  96         }
  97
  98         if (!hostapd_config_get_radius_attr(hapd->conf->radius_acct_req_attr,
  99                                             RADIUS_ATTR_NAS_IP_ADDRESS) &&
 100             hapd->conf->own_ip_addr.af == AF_INET &&
 101             !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IP_ADDRESS,
 102                                  (u8 *) &hapd->conf->own_ip_addr.u.v4, 4)) {
 103                 printf("Could not add NAS-IP-Address\n");
 104                 goto fail;
 105         }
 106
 107 #ifdef CONFIG_IPV6
 108         if (!hostapd_config_get_radius_attr(hapd->conf->radius_acct_req_attr,
 109                                             RADIUS_ATTR_NAS_IPV6_ADDRESS) &&
 110             hapd->conf->own_ip_addr.af == AF_INET6 &&
 111             !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IPV6_ADDRESS,
 112                                  (u8 *) &hapd->conf->own_ip_addr.u.v6, 16)) {
 113                 printf("Could not add NAS-IPv6-Address\n");
 114                 goto fail;
 115         }
 116 #endif /* CONFIG_IPV6 */
 117
 118         if (!hostapd_config_get_radius_attr(hapd->conf->radius_acct_req_attr,
 119                                             RADIUS_ATTR_NAS_IDENTIFIER) &&
 120             hapd->conf->nas_identifier &&
 121             !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IDENTIFIER,
 122                                  (u8 *) hapd->conf->nas_identifier,
 123                                  os_strlen(hapd->conf->nas_identifier))) {
 124                 printf("Could not add NAS-Identifier\n");
 125                 goto fail;
 126         }
 127
 128         if (!hostapd_config_get_radius_attr(hapd->conf->radius_acct_req_attr,
 129                                             RADIUS_ATTR_NAS_PORT) &&
 130             sta &&
 131             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT, sta->aid)) {
 132                 printf("Could not add NAS-Port\n");
 133                 goto fail;
 134         }
 135
 136         os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT ":%s",
 137                     MAC2STR(hapd->own_addr), hapd->conf->ssid.ssid);
 138         if (!hostapd_config_get_radius_attr(hapd->conf->radius_acct_req_attr,
 139                                             RADIUS_ATTR_CALLED_STATION_ID) &&
 140             !radius_msg_add_attr(msg, RADIUS_ATTR_CALLED_STATION_ID,
 141                                  (u8 *) buf, os_strlen(buf))) {
 142                 printf("Could not add Called-Station-Id\n");
 143                 goto fail;
 144         }
 145
 146         if (sta) {
 147                 os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT,
 148                             MAC2STR(sta->addr));
 149                 if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLING_STATION_ID,
 150                                          (u8 *) buf, os_strlen(buf))) {
 151                         printf("Could not add Calling-Station-Id\n");
 152                         goto fail;
 153                 }
 154
 155                 if (!hostapd_config_get_radius_attr(
 156                             hapd->conf->radius_acct_req_attr,
 157                             RADIUS_ATTR_NAS_PORT_TYPE) &&
 158                     !radius_msg_add_attr_int32(
 159                             msg, RADIUS_ATTR_NAS_PORT_TYPE,
 160                             RADIUS_NAS_PORT_TYPE_IEEE_802_11)) {
 161                         printf("Could not add NAS-Port-Type\n");
 162                         goto fail;
 163                 }
 164
 165                 os_snprintf(buf, sizeof(buf), "CONNECT %d%sMbps %s",
 166                             radius_sta_rate(hapd, sta) / 2,
 167                             (radius_sta_rate(hapd, sta) & 1) ? ".5" : "",
 168                             radius_mode_txt(hapd));
 169                 if (!hostapd_config_get_radius_attr(
 170                             hapd->conf->radius_acct_req_attr,
 171                             RADIUS_ATTR_CONNECT_INFO) &&
 172                     !radius_msg_add_attr(msg, RADIUS_ATTR_CONNECT_INFO,
 173                                          (u8 *) buf, os_strlen(buf))) {
 174                         printf("Could not add Connect-Info\n");
 175                         goto fail;
 176                 }
 177
 178                 for (i = 0; ; i++) {
 179                         val = ieee802_1x_get_radius_class(sta->eapol_sm, &len,
 180                                                           i);
 181                         if (val == NULL)
 182                                 break;
 183
 184                         if (!radius_msg_add_attr(msg, RADIUS_ATTR_CLASS,
 185                                                  val, len)) {
 186                                 printf("Could not add Class\n");
 187                                 goto fail;
 188                         }
 189                 }
 190
 191                 b = ieee802_1x_get_radius_cui(sta->eapol_sm);
 192                 if (b &&
 193                     !radius_msg_add_attr(msg,
 194                                          RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
 195                                          wpabuf_head(b), wpabuf_len(b))) {
 196                         wpa_printf(MSG_ERROR, "Could not add CUI");
 197                         goto fail;
 198                 }
 199         }
 200
 201         for (attr = hapd->conf->radius_acct_req_attr; attr; attr = attr->next)
 202         {
 203                 if (!radius_msg_add_attr(msg, attr->type,
 204                                          wpabuf_head(attr->val),
 205                                          wpabuf_len(attr->val))) {
 206                         wpa_printf(MSG_ERROR, "Could not add RADIUS "
 207                                    "attribute");
 208                         goto fail;
 209                 }
 210         }
 211
 212         return msg;
 213
 214  fail:
 215         radius_msg_free(msg);
 216         return NULL;
 217 }
 218
 219
 220 static int accounting_sta_update_stats(struct hostapd_data *hapd,
 221                                        struct sta_info *sta,
 222                                        struct hostap_sta_driver_data *data)
 223 {
 224         if (hostapd_drv_read_sta_data(hapd, data, sta->addr))
 225                 return -1;
 226
 227         if (sta->last_rx_bytes > data->rx_bytes)
 228                 sta->acct_input_gigawords++;
 229         if (sta->last_tx_bytes > data->tx_bytes)
 230                 sta->acct_output_gigawords++;
 231         sta->last_rx_bytes = data->rx_bytes;
 232         sta->last_tx_bytes = data->tx_bytes;
 233
 234         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
 235                        HOSTAPD_LEVEL_DEBUG, "updated TX/RX stats: "
 236                        "Acct-Input-Octets=%lu Acct-Input-Gigawords=%u "
 237                        "Acct-Output-Octets=%lu Acct-Output-Gigawords=%u",
 238                        sta->last_rx_bytes, sta->acct_input_gigawords,
 239                        sta->last_tx_bytes, sta->acct_output_gigawords);
 240
 241         return 0;
 242 }
 243
 244
 245 static void accounting_interim_update(void *eloop_ctx, void *timeout_ctx)
 246 {
 247         struct hostapd_data *hapd = eloop_ctx;
 248         struct sta_info *sta = timeout_ctx;
 249         int interval;
 250
 251         if (sta->acct_interim_interval) {
 252                 accounting_sta_interim(hapd, sta);
 253                 interval = sta->acct_interim_interval;
 254         } else {
 255                 struct hostap_sta_driver_data data;
 256                 accounting_sta_update_stats(hapd, sta, &data);
 257                 interval = ACCT_DEFAULT_UPDATE_INTERVAL;
 258         }
 259
 260         eloop_register_timeout(interval, 0, accounting_interim_update,
 261                                hapd, sta);
 262 }
 263
 264
 265 /**
 266  * accounting_sta_start - Start STA accounting
 267  * @hapd: hostapd BSS data
 268  * @sta: The station
 269  */
 270 void accounting_sta_start(struct hostapd_data *hapd, struct sta_info *sta)
 271 {
 272         struct radius_msg *msg;
 273         struct os_time t;
 274         int interval;
 275
 276         if (sta->acct_session_started)
 277                 return;
 278
 279         accounting_sta_get_id(hapd, sta);
 280         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
 281                        HOSTAPD_LEVEL_INFO,
 282                        "starting accounting session %08X-%08X",
 283                        sta->acct_session_id_hi, sta->acct_session_id_lo);
 284
 285         os_get_time(&t);
 286         sta->acct_session_start = t.sec;
 287         sta->last_rx_bytes = sta->last_tx_bytes = 0;
 288         sta->acct_input_gigawords = sta->acct_output_gigawords = 0;
 289         hostapd_drv_sta_clear_stats(hapd, sta->addr);
 290
 291         if (!hapd->conf->radius->acct_server)
 292                 return;
 293
 294         if (sta->acct_interim_interval)
 295                 interval = sta->acct_interim_interval;
 296         else
 297                 interval = ACCT_DEFAULT_UPDATE_INTERVAL;
 298         eloop_register_timeout(interval, 0, accounting_interim_update,
 299                                hapd, sta);
 300
 301         msg = accounting_msg(hapd, sta, RADIUS_ACCT_STATUS_TYPE_START);
 302         if (msg &&
 303             radius_client_send(hapd->radius, msg, RADIUS_ACCT, sta->addr) < 0)
 304                 radius_msg_free(msg);
 305
 306         sta->acct_session_started = 1;
 307 }
 308
 309
 310 static void accounting_sta_report(struct hostapd_data *hapd,
 311                                   struct sta_info *sta, int stop)
 312 {
 313         struct radius_msg *msg;
 314         int cause = sta->acct_terminate_cause;
 315         struct hostap_sta_driver_data data;
 316         struct os_time now;
 317         u32 gigawords;
 318
 319         if (!hapd->conf->radius->acct_server)
 320                 return;
 321
 322         msg = accounting_msg(hapd, sta,
 323                              stop ? RADIUS_ACCT_STATUS_TYPE_STOP :
 324                              RADIUS_ACCT_STATUS_TYPE_INTERIM_UPDATE);
 325         if (!msg) {
 326                 printf("Could not create RADIUS Accounting message\n");
 327                 return;
 328         }
 329
 330         os_get_time(&now);
 331         if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_SESSION_TIME,
 332                                        now.sec - sta->acct_session_start)) {
 333                 printf("Could not add Acct-Session-Time\n");
 334                 goto fail;
 335         }
 336
 337         if (accounting_sta_update_stats(hapd, sta, &data) == 0) {
 338                 if (!radius_msg_add_attr_int32(msg,
 339                                                RADIUS_ATTR_ACCT_INPUT_PACKETS,
 340                                                data.rx_packets)) {
 341                         printf("Could not add Acct-Input-Packets\n");
 342                         goto fail;
 343                 }
 344                 if (!radius_msg_add_attr_int32(msg,
 345                                                RADIUS_ATTR_ACCT_OUTPUT_PACKETS,
 346                                                data.tx_packets)) {
 347                         printf("Could not add Acct-Output-Packets\n");
 348                         goto fail;
 349                 }
 350                 if (!radius_msg_add_attr_int32(msg,
 351                                                RADIUS_ATTR_ACCT_INPUT_OCTETS,
 352                                                data.rx_bytes)) {
 353                         printf("Could not add Acct-Input-Octets\n");
 354                         goto fail;
 355                 }
 356                 gigawords = sta->acct_input_gigawords;
 357 #if __WORDSIZE == 64
 358                 gigawords += data.rx_bytes >> 32;
 359 #endif
 360                 if (gigawords &&
 361                     !radius_msg_add_attr_int32(
 362                             msg, RADIUS_ATTR_ACCT_INPUT_GIGAWORDS,
 363                             gigawords)) {
 364                         printf("Could not add Acct-Input-Gigawords\n");
 365                         goto fail;
 366                 }
 367                 if (!radius_msg_add_attr_int32(msg,
 368                                                RADIUS_ATTR_ACCT_OUTPUT_OCTETS,
 369                                                data.tx_bytes)) {
 370                         printf("Could not add Acct-Output-Octets\n");
 371                         goto fail;
 372                 }
 373                 gigawords = sta->acct_output_gigawords;
 374 #if __WORDSIZE == 64
 375                 gigawords += data.tx_bytes >> 32;
 376 #endif
 377                 if (gigawords &&
 378                     !radius_msg_add_attr_int32(
 379                             msg, RADIUS_ATTR_ACCT_OUTPUT_GIGAWORDS,
 380                             gigawords)) {
 381                         printf("Could not add Acct-Output-Gigawords\n");
 382                         goto fail;
 383                 }
 384         }
 385
 386         if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_EVENT_TIMESTAMP,
 387                                        now.sec)) {
 388                 printf("Could not add Event-Timestamp\n");
 389                 goto fail;
 390         }
 391
 392         if (eloop_terminated())
 393                 cause = RADIUS_ACCT_TERMINATE_CAUSE_ADMIN_REBOOT;
 394
 395         if (stop && cause &&
 396             !radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_TERMINATE_CAUSE,
 397                                        cause)) {
 398                 printf("Could not add Acct-Terminate-Cause\n");
 399                 goto fail;
 400         }
 401
 402         if (radius_client_send(hapd->radius, msg,
 403                                stop ? RADIUS_ACCT : RADIUS_ACCT_INTERIM,
 404                                sta->addr) < 0)
 405                 goto fail;
 406         return;
 407
 408  fail:
 409         radius_msg_free(msg);
 410 }
 411
 412
 413 /**
 414  * accounting_sta_interim - Send a interim STA accounting report
 415  * @hapd: hostapd BSS data
 416  * @sta: The station
 417  */
 418 void accounting_sta_interim(struct hostapd_data *hapd, struct sta_info *sta)
 419 {
 420         if (sta->acct_session_started)
 421                 accounting_sta_report(hapd, sta, 0);
 422 }
 423
 424
 425 /**
 426  * accounting_sta_stop - Stop STA accounting
 427  * @hapd: hostapd BSS data
 428  * @sta: The station
 429  */
 430 void accounting_sta_stop(struct hostapd_data *hapd, struct sta_info *sta)
 431 {
 432         if (sta->acct_session_started) {
 433                 accounting_sta_report(hapd, sta, 1);
 434                 eloop_cancel_timeout(accounting_interim_update, hapd, sta);
 435                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
 436                                HOSTAPD_LEVEL_INFO,
 437                                "stopped accounting session %08X-%08X",
 438                                sta->acct_session_id_hi,
 439                                sta->acct_session_id_lo);
 440                 sta->acct_session_started = 0;
 441         }
 442 }
 443
 444
 445 static void accounting_sta_get_id(struct hostapd_data *hapd,
 446                                   struct sta_info *sta)
 447 {
 448         sta->acct_session_id_lo = hapd->acct_session_id_lo++;
 449         if (hapd->acct_session_id_lo == 0) {
 450                 hapd->acct_session_id_hi++;
 451         }
 452         sta->acct_session_id_hi = hapd->acct_session_id_hi;
 453 }
 454
 455
 456 /**
 457  * accounting_receive - Process the RADIUS frames from Accounting Server
 458  * @msg: RADIUS response message
 459  * @req: RADIUS request message
 460  * @shared_secret: RADIUS shared secret
 461  * @shared_secret_len: Length of shared_secret in octets
 462  * @data: Context data (struct hostapd_data *)
 463  * Returns: Processing status
 464  */
 465 static RadiusRxResult
 466 accounting_receive(struct radius_msg *msg, struct radius_msg *req,
 467                    const u8 *shared_secret, size_t shared_secret_len,
 468                    void *data)
 469 {
 470         if (radius_msg_get_hdr(msg)->code != RADIUS_CODE_ACCOUNTING_RESPONSE) {
 471                 printf("Unknown RADIUS message code\n");
 472                 return RADIUS_RX_UNKNOWN;
 473         }
 474
 475         if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 0)) {
 476                 printf("Incoming RADIUS packet did not have correct "
 477                        "Authenticator - dropped\n");
 478                 return RADIUS_RX_INVALID_AUTHENTICATOR;
 479         }
 480
 481         return RADIUS_RX_PROCESSED;
 482 }
 483
 484
 485 static void accounting_report_state(struct hostapd_data *hapd, int on)
 486 {
 487         struct radius_msg *msg;
 488
 489         if (!hapd->conf->radius->acct_server || hapd->radius == NULL)
 490                 return;
 491
 492         /* Inform RADIUS server that accounting will start/stop so that the
 493          * server can close old accounting sessions. */
 494         msg = accounting_msg(hapd, NULL,
 495                              on ? RADIUS_ACCT_STATUS_TYPE_ACCOUNTING_ON :
 496                              RADIUS_ACCT_STATUS_TYPE_ACCOUNTING_OFF);
 497         if (!msg)
 498                 return;
 499
 500         if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_ACCT_TERMINATE_CAUSE,
 501                                        RADIUS_ACCT_TERMINATE_CAUSE_NAS_REBOOT))
 502         {
 503                 printf("Could not add Acct-Terminate-Cause\n");
 504                 radius_msg_free(msg);
 505                 return;
 506         }
 507
 508         if (radius_client_send(hapd->radius, msg, RADIUS_ACCT, NULL) < 0)
 509                 radius_msg_free(msg);
 510 }
 511
 512
 513 /**
 514  * accounting_init: Initialize accounting
 515  * @hapd: hostapd BSS data
 516  * Returns: 0 on success, -1 on failure
 517  */
 518 int accounting_init(struct hostapd_data *hapd)
 519 {
 520         struct os_time now;
 521
 522         /* Acct-Session-Id should be unique over reboots. If reliable clock is
 523          * not available, this could be replaced with reboot counter, etc. */
 524         os_get_time(&now);
 525         hapd->acct_session_id_hi = now.sec;
 526
 527         if (radius_client_register(hapd->radius, RADIUS_ACCT,
 528                                    accounting_receive, hapd))
 529                 return -1;
 530
 531         accounting_report_state(hapd, 1);
 532
 533         return 0;
 534 }
 535
 536
 537 /**
 538  * accounting_deinit: Deinitilize accounting
 539  * @hapd: hostapd BSS data
 540  */
 541 void accounting_deinit(struct hostapd_data *hapd)
 542 {
 543         accounting_report_state(hapd, 0);
 544 }