src/libcharon/plugins/eap_radius/eap_radius_accounting.c

   1 /*
   2  * Copyright (C) 2012 Martin Willi
   3  * Copyright (C) 2012 revosec AG
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "eap_radius_accounting.h"
  17 #include "eap_radius_plugin.h"
  18
  19 #include <time.h>
  20
  21 #include <radius_message.h>
  22 #include <radius_client.h>
  23 #include <daemon.h>
  24 #include <collections/hashtable.h>
  25 #include <threading/mutex.h>
  26
  27 typedef struct private_eap_radius_accounting_t private_eap_radius_accounting_t;
  28
  29 /**
  30  * Private data of an eap_radius_accounting_t object.
  31  */
  32 struct private_eap_radius_accounting_t {
  33
  34         /**
  35          * Public eap_radius_accounting_t interface.
  36          */
  37         eap_radius_accounting_t public;
  38
  39         /**
  40          * Hashtable with sessions, IKE_SA unique id => entry_t
  41          */
  42         hashtable_t *sessions;
  43
  44         /**
  45          * Mutex to lock sessions
  46          */
  47         mutex_t *mutex;
  48
  49         /**
  50          * Session ID prefix
  51          */
  52         u_int32_t prefix;
  53 };
  54
  55 /**
  56  * Hashtable entry with usage stats
  57  */
  58 typedef struct {
  59         /** RADIUS accounting session ID */
  60         char sid[16];
  61         /** number of sent/received octets/packets */
  62         struct {
  63                 u_int64_t sent;
  64                 u_int64_t received;
  65         } bytes, packets;
  66         /** session creation time */
  67         time_t created;
  68 } entry_t;
  69
  70 /**
  71  * Accounting message status types
  72  */
  73 typedef enum {
  74         ACCT_STATUS_START = 1,
  75         ACCT_STATUS_STOP = 2,
  76         ACCT_STATUS_INTERIM_UPDATE = 3,
  77         ACCT_STATUS_ACCOUNTING_ON = 7,
  78         ACCT_STATUS_ACCOUNTING_OFF = 8,
  79 } radius_acct_status_t;
  80
  81 /**
  82  * Hashtable hash function
  83  */
  84 static u_int hash(uintptr_t key)
  85 {
  86         return key;
  87 }
  88
  89 /**
  90  * Hashtable equals function
  91  */
  92 static bool equals(uintptr_t a, uintptr_t b)
  93 {
  94         return a == b;
  95 }
  96
  97 /**
  98  * Update usage counter when a CHILD_SA rekeys/goes down
  99  */
 100 static void update_usage(private_eap_radius_accounting_t *this,
 101                                                  ike_sa_t *ike_sa, child_sa_t *child_sa)
 102 {
 103         u_int64_t bytes_in, bytes_out, packets_in, packets_out;
 104         entry_t *entry;
 105
 106         child_sa->get_usestats(child_sa, FALSE, NULL, &bytes_out, &packets_out);
 107         child_sa->get_usestats(child_sa, TRUE, NULL, &bytes_in, &packets_in);
 108
 109         this->mutex->lock(this->mutex);
 110         entry = this->sessions->get(this->sessions,
 111                                                                 (void*)(uintptr_t)ike_sa->get_unique_id(ike_sa));
 112         if (entry)
 113         {
 114                 entry->bytes.sent += bytes_out;
 115                 entry->bytes.received += bytes_in;
 116                 entry->packets.sent += packets_out;
 117                 entry->packets.received += packets_in;
 118         }
 119         this->mutex->unlock(this->mutex);
 120 }
 121
 122 /**
 123  * Send a RADIUS message, wait for response
 124  */
 125 static bool send_message(private_eap_radius_accounting_t *this,
 126                                                  radius_message_t *request)
 127 {
 128         radius_message_t *response;
 129         radius_client_t *client;
 130         bool ack = FALSE;
 131
 132         client = eap_radius_create_client();
 133         if (client)
 134         {
 135                 response = client->request(client, request);
 136                 if (response)
 137                 {
 138                         ack = response->get_code(response) == RMC_ACCOUNTING_RESPONSE;
 139                         response->destroy(response);
 140                 }
 141                 else
 142                 {
 143                         charon->bus->alert(charon->bus, ALERT_RADIUS_NOT_RESPONDING);
 144                 }
 145                 client->destroy(client);
 146         }
 147         return ack;
 148 }
 149
 150 /**
 151  * Add common IKE_SA parameters to RADIUS account message
 152  */
 153 static void add_ike_sa_parameters(radius_message_t *message, ike_sa_t *ike_sa)
 154 {
 155         enumerator_t *enumerator;
 156         host_t *vip;
 157         char buf[64];
 158         chunk_t data;
 159
 160         snprintf(buf, sizeof(buf), "%Y", ike_sa->get_other_eap_id(ike_sa));
 161         message->add(message, RAT_USER_NAME, chunk_create(buf, strlen(buf)));
 162         snprintf(buf, sizeof(buf), "%#H", ike_sa->get_other_host(ike_sa));
 163         message->add(message, RAT_CALLING_STATION_ID, chunk_create(buf, strlen(buf)));
 164
 165         enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, FALSE);
 166         while (enumerator->enumerate(enumerator, &vip))
 167         {
 168                 switch (vip->get_family(vip))
 169                 {
 170                         case AF_INET:
 171                                 message->add(message, RAT_FRAMED_IP_ADDRESS,
 172                                                          vip->get_address(vip));
 173                                 break;
 174                         case AF_INET6:
 175                                 /* we currently assign /128 prefixes, only (reserved, length) */
 176                                 data = chunk_from_chars(0, 128);
 177                                 data = chunk_cata("cc", data, vip->get_address(vip));
 178                                 message->add(message, RAT_FRAMED_IPV6_PREFIX, data);
 179                                 break;
 180                         default:
 181                                 break;
 182                 }
 183         }
 184         enumerator->destroy(enumerator);
 185 }
 186
 187 /**
 188  * Send an accounting start message
 189  */
 190 static void send_start(private_eap_radius_accounting_t *this, ike_sa_t *ike_sa)
 191 {
 192         radius_message_t *message;
 193         entry_t *entry;
 194         u_int32_t id, value;
 195
 196         id = ike_sa->get_unique_id(ike_sa);
 197         INIT(entry,
 198                 .created = time_monotonic(NULL),
 199         );
 200         snprintf(entry->sid, sizeof(entry->sid), "%u-%u", this->prefix, id);
 201
 202         message = radius_message_create(RMC_ACCOUNTING_REQUEST);
 203         value = htonl(ACCT_STATUS_START);
 204         message->add(message, RAT_ACCT_STATUS_TYPE, chunk_from_thing(value));
 205         message->add(message, RAT_ACCT_SESSION_ID,
 206                                  chunk_create(entry->sid, strlen(entry->sid)));
 207         add_ike_sa_parameters(message, ike_sa);
 208         if (send_message(this, message))
 209         {
 210                 this->mutex->lock(this->mutex);
 211                 entry = this->sessions->put(this->sessions, (void*)(uintptr_t)id, entry);
 212                 this->mutex->unlock(this->mutex);
 213         }
 214         message->destroy(message);
 215         free(entry);
 216 }
 217
 218 /**
 219  * Send an account stop message
 220  */
 221 static void send_stop(private_eap_radius_accounting_t *this, ike_sa_t *ike_sa)
 222 {
 223         radius_message_t *message;
 224         entry_t *entry;
 225         u_int32_t id, value;
 226
 227         id = ike_sa->get_unique_id(ike_sa);
 228         this->mutex->lock(this->mutex);
 229         entry = this->sessions->remove(this->sessions, (void*)(uintptr_t)id);
 230         this->mutex->unlock(this->mutex);
 231         if (entry)
 232         {
 233                 message = radius_message_create(RMC_ACCOUNTING_REQUEST);
 234                 value = htonl(ACCT_STATUS_STOP);
 235                 message->add(message, RAT_ACCT_STATUS_TYPE, chunk_from_thing(value));
 236                 message->add(message, RAT_ACCT_SESSION_ID,
 237                                          chunk_create(entry->sid, strlen(entry->sid)));
 238                 add_ike_sa_parameters(message, ike_sa);
 239
 240                 value = htonl(entry->bytes.sent);
 241                 message->add(message, RAT_ACCT_OUTPUT_OCTETS, chunk_from_thing(value));
 242                 value = htonl(entry->bytes.sent >> 32);
 243                 if (value)
 244                 {
 245                         message->add(message, RAT_ACCT_OUTPUT_GIGAWORDS,
 246                                                  chunk_from_thing(value));
 247                 }
 248                 value = htonl(entry->packets.sent);
 249                 message->add(message, RAT_ACCT_OUTPUT_PACKETS, chunk_from_thing(value));
 250
 251                 value = htonl(entry->bytes.received);
 252                 message->add(message, RAT_ACCT_INPUT_OCTETS, chunk_from_thing(value));
 253                 value = htonl(entry->bytes.received >> 32);
 254                 if (value)
 255                 {
 256                         message->add(message, RAT_ACCT_INPUT_GIGAWORDS,
 257                                                  chunk_from_thing(value));
 258                 }
 259                 value = htonl(entry->packets.received);
 260                 message->add(message, RAT_ACCT_INPUT_PACKETS, chunk_from_thing(value));
 261
 262                 value = htonl(time_monotonic(NULL) - entry->created);
 263                 message->add(message, RAT_ACCT_SESSION_TIME, chunk_from_thing(value));
 264
 265                 send_message(this, message);
 266                 message->destroy(message);
 267                 free(entry);
 268         }
 269 }
 270
 271 METHOD(listener_t, ike_updown, bool,
 272         private_eap_radius_accounting_t *this, ike_sa_t *ike_sa, bool up)
 273 {
 274         if (!up)
 275         {
 276                 enumerator_t *enumerator;
 277                 child_sa_t *child_sa;
 278
 279                 /* update usage for all children just before sending stop */
 280                 enumerator = ike_sa->create_child_sa_enumerator(ike_sa);
 281                 while (enumerator->enumerate(enumerator, &child_sa))
 282                 {
 283                         update_usage(this, ike_sa, child_sa);
 284                 }
 285                 enumerator->destroy(enumerator);
 286
 287                 send_stop(this, ike_sa);
 288         }
 289         return TRUE;
 290 }
 291
 292 METHOD(listener_t, message_hook, bool,
 293         private_eap_radius_accounting_t *this, ike_sa_t *ike_sa,
 294         message_t *message, bool incoming, bool plain)
 295 {
 296         /* start accounting here, virtual IP now is set */
 297         if (plain && ike_sa->get_state(ike_sa) == IKE_ESTABLISHED &&
 298                 !incoming && !message->get_request(message))
 299         {
 300                 if (ike_sa->get_version(ike_sa) == IKEV1 &&
 301                         message->get_exchange_type(message) == TRANSACTION)
 302                 {
 303                         send_start(this, ike_sa);
 304                 }
 305                 if (ike_sa->get_version(ike_sa) == IKEV2 &&
 306                         message->get_exchange_type(message) == IKE_AUTH)
 307                 {
 308                         send_start(this, ike_sa);
 309                 }
 310         }
 311         return TRUE;
 312 }
 313
 314 METHOD(listener_t, ike_rekey, bool,
 315         private_eap_radius_accounting_t *this, ike_sa_t *old, ike_sa_t *new)
 316 {
 317         entry_t *entry;
 318
 319         this->mutex->lock(this->mutex);
 320         entry = this->sessions->remove(this->sessions,
 321                                                         (void*)(uintptr_t)old->get_unique_id(old));
 322         if (entry)
 323         {
 324                 entry = this->sessions->put(this->sessions,
 325                                                         (void*)(uintptr_t)new->get_unique_id(new), entry);
 326                 if (entry)
 327                 {
 328                         free(entry);
 329                 }
 330         }
 331         this->mutex->unlock(this->mutex);
 332
 333         return TRUE;
 334 }
 335
 336 METHOD(listener_t, child_rekey, bool,
 337         private_eap_radius_accounting_t *this, ike_sa_t *ike_sa,
 338         child_sa_t *old, child_sa_t *new)
 339 {
 340         update_usage(this, ike_sa, old);
 341
 342         return TRUE;
 343 }
 344
 345 METHOD(listener_t, child_updown, bool,
 346         private_eap_radius_accounting_t *this, ike_sa_t *ike_sa,
 347         child_sa_t *child_sa, bool up)
 348 {
 349         if (!up && ike_sa->get_state(ike_sa) == IKE_ESTABLISHED)
 350         {
 351                 update_usage(this, ike_sa, child_sa);
 352         }
 353         return TRUE;
 354 }
 355
 356 METHOD(eap_radius_accounting_t, destroy, void,
 357         private_eap_radius_accounting_t *this)
 358 {
 359         this->mutex->destroy(this->mutex);
 360         this->sessions->destroy(this->sessions);
 361         free(this);
 362 }
 363
 364 /**
 365  * See header
 366  */
 367 eap_radius_accounting_t *eap_radius_accounting_create()
 368 {
 369         private_eap_radius_accounting_t *this;
 370
 371         INIT(this,
 372                 .public = {
 373                         .listener = {
 374                                 .ike_updown = _ike_updown,
 375                                 .ike_rekey = _ike_rekey,
 376                                 .message = _message_hook,
 377                                 .child_updown = _child_updown,
 378                                 .child_rekey = _child_rekey,
 379                         },
 380                         .destroy = _destroy,
 381                 },
 382                 /* use system time as Session ID prefix */
 383                 .prefix = (u_int32_t)time(NULL),
 384                 .sessions = hashtable_create((hashtable_hash_t)hash,
 385                                                                          (hashtable_equals_t)equals, 32),
 386                 .mutex = mutex_create(MUTEX_TYPE_DEFAULT),
 387         );
 388
 389         return &this->public;
 390 }