861beb7269
Previously, the first matching STA was picked. That is not really the design in RFC 5176, so extend this matching code to go through all specified session identification attributes and verify that all of them match. In addition, check for a possible case of multiple sessions matching. If such a case is detected, return with Disconnect-NAK and Error-Code 508 (multiple session selection not supported). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
55 lines
1.2 KiB
C
55 lines
1.2 KiB
C
/*
|
|
* RADIUS Dynamic Authorization Server (DAS)
|
|
* Copyright (c) 2012, Jouni Malinen <j@w1.fi>
|
|
*
|
|
* This software may be distributed under the terms of the BSD license.
|
|
* See README for more details.
|
|
*/
|
|
|
|
#ifndef RADIUS_DAS_H
|
|
#define RADIUS_DAS_H
|
|
|
|
struct radius_das_data;
|
|
|
|
enum radius_das_res {
|
|
RADIUS_DAS_SUCCESS,
|
|
RADIUS_DAS_NAS_MISMATCH,
|
|
RADIUS_DAS_SESSION_NOT_FOUND,
|
|
RADIUS_DAS_MULTI_SESSION_MATCH,
|
|
};
|
|
|
|
struct radius_das_attrs {
|
|
/* NAS identification attributes */
|
|
const u8 *nas_ip_addr;
|
|
const u8 *nas_identifier;
|
|
size_t nas_identifier_len;
|
|
const u8 *nas_ipv6_addr;
|
|
|
|
/* Session identification attributes */
|
|
const u8 *sta_addr;
|
|
const u8 *user_name;
|
|
size_t user_name_len;
|
|
const u8 *acct_session_id;
|
|
size_t acct_session_id_len;
|
|
const u8 *cui;
|
|
size_t cui_len;
|
|
};
|
|
|
|
struct radius_das_conf {
|
|
int port;
|
|
const u8 *shared_secret;
|
|
size_t shared_secret_len;
|
|
const struct hostapd_ip_addr *client_addr;
|
|
unsigned int time_window;
|
|
int require_event_timestamp;
|
|
void *ctx;
|
|
enum radius_das_res (*disconnect)(void *ctx,
|
|
struct radius_das_attrs *attr);
|
|
};
|
|
|
|
struct radius_das_data *
|
|
radius_das_init(struct radius_das_conf *conf);
|
|
|
|
void radius_das_deinit(struct radius_das_data *data);
|
|
|
|
#endif /* RADIUS_DAS_H */
|