RADIUS DAS: Support Acct-Multi-Session-Id as a session identifier

This extends Disconnect-Request support for an additiona session
identification attribute.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
index dea552c1c0cbbf90740191bb36907f33ca87e416..81e9b2b15bedde24c5f650a5b096e73260be1986 100644 (file)
--- a/src/ap/hostapd.c
+++ b/src/ap/hostapd.c
@@ -15,6 +15,8 @@
 #include "radius/radius_client.h"
 #include "radius/radius_das.h"
 #include "eap_server/tncs.h"
+#include "eapol_auth/eapol_auth_sm.h"
+#include "eapol_auth/eapol_auth_sm_i.h"
 #include "hostapd.h"
 #include "authsrv.h"
 #include "sta_info.h"
@@ -673,6 +675,42 @@ static struct sta_info * hostapd_das_find_sta(struct hostapd_data *hapd,
                wpa_printf(MSG_DEBUG, "RADIUS DAS: Acct-Session-Id match");
        }
 
+       if (attr->acct_multi_session_id) {
+               num_attr++;
+               if (attr->acct_multi_session_id_len != 17) {
+                       wpa_printf(MSG_DEBUG,
+                                  "RADIUS DAS: Acct-Multi-Session-Id cannot match");
+                       return NULL;
+               }
+               count = 0;
+
+               for (sta = hapd->sta_list; sta; sta = sta->next) {
+                       if (!sta->radius_das_match)
+                               continue;
+                       if (!sta->eapol_sm ||
+                           !sta->eapol_sm->acct_multi_session_id_hi) {
+                               sta->radius_das_match = 0;
+                               continue;
+                       }
+                       os_snprintf(buf, sizeof(buf), "%08X+%08X",
+                                   sta->eapol_sm->acct_multi_session_id_hi,
+                                   sta->eapol_sm->acct_multi_session_id_lo);
+                       if (os_memcmp(attr->acct_multi_session_id, buf, 17) !=
+                           0)
+                               sta->radius_das_match = 0;
+                       else
+                               count++;
+               }
+
+               if (count == 0) {
+                       wpa_printf(MSG_DEBUG,
+                                  "RADIUS DAS: No matches remaining after Acct-Multi-Session-Id check");
+                       return NULL;
+               }
+               wpa_printf(MSG_DEBUG,
+                          "RADIUS DAS: Acct-Multi-Session-Id match");
+       }
+
        if (attr->cui) {
                num_attr++;
                count = 0;

diff --git a/src/radius/radius_das.c b/src/radius/radius_das.c
index 7aa703cc6130d8eadaebcad825716d2a3e0abe2f..39ceea879cafeeffd2059c51dbaac5f9f9c63975 100644 (file)
--- a/src/radius/radius_das.c
+++ b/src/radius/radius_das.c
@@ -42,6 +42,7 @@ static struct radius_msg * radius_das_disconnect(struct radius_das_data *das,
                RADIUS_ATTR_CALLING_STATION_ID,
                RADIUS_ATTR_NAS_IDENTIFIER,
                RADIUS_ATTR_ACCT_SESSION_ID,
+               RADIUS_ATTR_ACCT_MULTI_SESSION_ID,
                RADIUS_ATTR_EVENT_TIMESTAMP,
                RADIUS_ATTR_MESSAGE_AUTHENTICATOR,
                RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
@@ -129,6 +130,12 @@ static struct radius_msg * radius_das_disconnect(struct radius_das_data *das,
                attrs.acct_session_id_len = len;
        }
 
+       if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_ACCT_MULTI_SESSION_ID,
+                                   &buf, &len, NULL) == 0) {
+               attrs.acct_multi_session_id = buf;
+               attrs.acct_multi_session_id_len = len;
+       }
+
        if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_CHARGEABLE_USER_IDENTITY,
                                    &buf, &len, NULL) == 0) {
                attrs.cui = buf;

diff --git a/src/radius/radius_das.h b/src/radius/radius_das.h
index 1d76c26624211ce9665cde7b7c6b459eb175133c..ce731d46a9ace1a7379ff36e6dff7ecd536b4fc9 100644 (file)
--- a/src/radius/radius_das.h
+++ b/src/radius/radius_das.h
@@ -31,6 +31,8 @@ struct radius_das_attrs {
        size_t user_name_len;
        const u8 *acct_session_id;
        size_t acct_session_id_len;
+       const u8 *acct_multi_session_id;
+       size_t acct_multi_session_id_len;
        const u8 *cui;
        size_t cui_len;
 };