/**
* Reads all received attributes after sending the request.
*
* This methods stores known attributes in the property attributes,
* all attributes (including known attibutes) are stored in rawAttributes
* or rawVendorAttributes.
* NOTE: call this function also even if the request was rejected, because the
* Server returns usualy an errormessage
*
* @access public
* @return bool true on success, false on error
*/
function getAttributes()
{
while ($attrib = radius_get_attr($this->res)) {
if (!is_array($attrib)) {
return false;
}
$attr = $attrib['attr'];
$data = $attrib['data'];
$this->rawAttributes[$attr] = $data;
switch ($attr) {
case RADIUS_FRAMED_IP_ADDRESS:
$this->attributes['framed_ip'] = radius_cvt_addr($data);
break;
case RADIUS_FRAMED_IP_NETMASK:
$this->attributes['framed_mask'] = radius_cvt_addr($data);
break;
case RADIUS_FRAMED_MTU:
$this->attributes['framed_mtu'] = radius_cvt_int($data);
break;
case RADIUS_FRAMED_COMPRESSION:
$this->attributes['framed_compression'] = radius_cvt_int($data);
break;
case RADIUS_SESSION_TIMEOUT:
$this->attributes['session_timeout'] = radius_cvt_int($data);
break;
case RADIUS_IDLE_TIMEOUT:
$this->attributes['idle_timeout'] = radius_cvt_int($data);
break;
case RADIUS_SERVICE_TYPE:
$this->attributes['service_type'] = radius_cvt_int($data);
break;
case RADIUS_CLASS:
$this->attributes['class'] = radius_cvt_string($data);
break;
case RADIUS_FRAMED_PROTOCOL:
$this->attributes['framed_protocol'] = radius_cvt_int($data);
break;
case RADIUS_FRAMED_ROUTING:
$this->attributes['framed_routing'] = radius_cvt_int($data);
break;
case RADIUS_FILTER_ID:
$this->attributes['filter_id'] = radius_cvt_string($data);
break;
case RADIUS_REPLY_MESSAGE:
$this->attributes['reply_message'] = radius_cvt_string($data);
break;
case RADIUS_VENDOR_SPECIFIC:
$attribv = radius_get_vendor_attr($data);
if (!is_array($attribv)) {
return false;
}
$vendor = $attribv['vendor'];
$attrv = $attribv['attr'];
$datav = $attribv['data'];
$this->rawVendorAttributes[$vendor][$attrv] = $datav;
if ($vendor == RADIUS_VENDOR_MICROSOFT) {
switch ($attrv) {
case RADIUS_MICROSOFT_MS_CHAP2_SUCCESS:
$this->attributes['ms_chap2_success'] = radius_cvt_string($datav);
break;
case RADIUS_MICROSOFT_MS_CHAP_ERROR:
$this->attributes['ms_chap_error'] = radius_cvt_string(substr($datav, 1));
break;
case RADIUS_MICROSOFT_MS_CHAP_DOMAIN:
$this->attributes['ms_chap_domain'] = radius_cvt_string($datav);
break;
case RADIUS_MICROSOFT_MS_MPPE_ENCRYPTION_POLICY:
$this->attributes['ms_mppe_encryption_policy'] = radius_cvt_int($datav);
break;
case RADIUS_MICROSOFT_MS_MPPE_ENCRYPTION_TYPES:
$this->attributes['ms_mppe_encryption_types'] = radius_cvt_int($datav);
break;
case RADIUS_MICROSOFT_MS_CHAP_MPPE_KEYS:
$demangled = radius_demangle($this->res, $datav);
$this->attributes['ms_chap_mppe_lm_key'] = substr($demangled, 0, 8);
$this->attributes['ms_chap_mppe_nt_key'] = substr($demangled, 8, RADIUS_MPPE_KEY_LEN);
break;
case RADIUS_MICROSOFT_MS_MPPE_SEND_KEY:
$this->attributes['ms_chap_mppe_send_key'] = radius_demangle_mppe_key($this->res, $datav);
break;
case RADIUS_MICROSOFT_MS_MPPE_RECV_KEY:
$this->attributes['ms_chap_mppe_recv_key'] = radius_demangle_mppe_key($this->res, $datav);
break;
case RADIUS_MICROSOFT_MS_PRIMARY_DNS_SERVER:
$this->attributes['ms_primary_dns_server'] = radius_cvt_string($datav);
break;
}
}
break;
}
}
return true;
}
case RADIUS_MICROSOFT_MS_CHAP_MPPE_KEYS:
$demangled = radius_demangle($res, $datav);
$lmkey = substr($demangled, 0, 8);
$ntkey = substr($demangled, 8, RADIUS_MPPE_KEY_LEN);
printf("MS MPPE Keys: LM-Key: %s NT-Key: %s<br>\n", bin2hex($lmkey), bin2hex($ntkey));
break;
case RADIUS_MICROSOFT_MS_MPPE_SEND_KEY:
$demangled = radius_demangle_mppe_key($res, $datav);
printf("MS MPPE Send Key: %s<br>\n", bin2hex($demangled));
break;
case RADIUS_MICROSOFT_MS_MPPE_RECV_KEY:
$demangled = radius_demangle_mppe_key($res, $datav);
printf("MS MPPE Send Key: %s<br>\n", bin2hex($demangled));
break;
case RADIUS_MICROSOFT_MS_PRIMARY_DNS_SERVER:
$server = radius_cvt_string($datav);
printf("MS Primary DNS Server: %s<br>\n", $server);
break;
default:
printf("Unexpected Microsoft attribute: %d<br>\n", $attrv);
}
}
} else {
printf("Error getting Vendor attribute %s<br>\n", radius_strerror($res));
}
break;
default:
printf("Unexpected attribute: %d<br>\n", $attr);
}
}
$secret = radius_server_secret($res);
/**
* Validate login credentials
*
* @param string $uname - The user name requesting access
* @param string $pass - Password to use (usually plain text)
* @param pointer &$newvals - pointer to array to accept other data read from database
* @param boolean $connect_only - TRUE to simply connect to the server
*
* @return integer result (AUTH_xxxx)
*
* On a successful login, &$newvals array is filled with the requested data from the server
*/
function login($uname, $pass, &$newvals, $connect_only = FALSE)
{
// Create authentification request
if (!radius_create_request($this->connection, RADIUS_ACCESS_REQUEST)) {
$this->makeErrorText('RADIUS failed authentification request: ');
return AUTH_NOCONNECT;
}
if (trim($pass) == '') {
return AUTH_BADPASSWORD;
}
// Pick up a blank password - always expect one
// Attach username and password
if (!radius_put_attr($this->connection, RADIUS_USER_NAME, $uname) || !radius_put_attr($this->connection, RADIUS_USER_PASSWORD, $pass)) {
$this->makeErrorText('RADIUS could not attach username/password: '******'CHAP not supported');
return AUTH_NOUSER;
case RADIUS_ACCESS_REJECT:
// Specifically rejected
// Specifically rejected
default:
// Catch-all
$this->makeErrorText('RADIUS validation error: ');
return AUTH_NOUSER;
}
// User accepted here.
if ($connect_only) {
return AUTH_SUCCESS;
}
return AUTH_SUCCESS;
// Not interested in any attributes returned ATM, so done.
// See if we get any attributes - not really any use to us unless we implement CHAP, so disabled ATM
$attribs = array();
while ($resa = radius_get_attr($this->connection)) {
if (!is_array($resa)) {
$this->makeErrorText("Error getting attribute: ");
exit;
}
// Decode attribute according to type (this isn't an exhaustive list)
// Codes: 2, 3, 4, 5, 30, 31, 32, 60, 61 should never be received by us
// Codes 17, 21 not assigned
switch ($resa['attr']) {
case 8:
// IP address to be set (255.255.255.254 indicates 'allocate your own address')
// IP address to be set (255.255.255.254 indicates 'allocate your own address')
case 9:
// Subnet mask
// Subnet mask
case 14:
// Login-IP host
$attribs[$resa['attr']] = radius_cvt_addr($resa['data']);
break;
case 6:
// Service type (integer bitmap)
// Service type (integer bitmap)
case 7:
// Protocol (integer bitmap)
// Protocol (integer bitmap)
case 10:
// Routing method (integer)
// Routing method (integer)
case 12:
// Framed MTU
// Framed MTU
case 13:
// Compression method
// Compression method
case 15:
// Login service (bitmap)
// Login service (bitmap)
case 16:
// Login TCP port
// Login TCP port
case 23:
// Framed IPX network (0xFFFFFFFE indicates 'allocate your own')
// Framed IPX network (0xFFFFFFFE indicates 'allocate your own')
case 27:
// Session timeout - maximum connection/login time in seconds
// Session timeout - maximum connection/login time in seconds
case 28:
// Idle timeout in seconds
// Idle timeout in seconds
case 29:
// Termination action
// Termination action
case 37:
// AppleTalk link number
// AppleTalk link number
case 38:
// AppleTalk network
// AppleTalk network
case 62:
// Max ports
// Max ports
case 63:
// Login LAT port
$attribs[$resa['attr']] = radius_cvt_int($resa['data']);
break;
case 1:
// User name
// User name
case 11:
// Filter ID - could get several of these
// Filter ID - could get several of these
case 18:
// Reply message (text, various purposes)
// Reply message (text, various purposes)
case 19:
// Callback number
// Callback number
case 20:
// Callback ID
// Callback ID
case 22:
// Framed route - could get several of these
// Framed route - could get several of these
case 24:
// State - used in CHAP
// State - used in CHAP
case 25:
// Class
// Class
case 26:
// Vendor-specific
// Vendor-specific
case 33:
// Proxy State
// Proxy State
case 34:
// Login LAT service
// Login LAT service
case 35:
// Login LAT node
// Login LAT node
case 36:
// Login LAT group
// Login LAT group
case 39:
// AppleTalk zone
// AppleTalk zone
default:
$attribs[$resa['attr']] = radius_cvt_string($resa['data']);
// Default to string type
}
printf("Got Attr: %d => %d Bytes %s\n", $resa['attr'], strlen($attribs[$resa['attr']]), $attribs[$resa['attr']]);
}
return AUTH_SUCCESS;
}
/**
* Retrieve user auth level for specified user.
*
* @param string $username Username to retrieve the auth level for
* @return int User's auth level
*/
function radius_auth_user_level($username)
{
global $config, $rad, $cache;
$rad_userlevel = 0;
if (isset($config['auth_radius_groups'])) {
// If groups set, try to search group attribute and set user level
if (!isset($cache['radius']['level'][$username])) {
if ($config['auth_radius_groupmemberattr'] == 18 || strtolower($config['auth_radius_groupmemberattr']) == 'reply-message') {
// Reply-Message (18)
$attribute = RADIUS_REPLY_MESSAGE;
} else {
// Filter-Id (11)
$attribute = RADIUS_FILTER_ID;
}
$rad_groups = array();
while ($rad_attr = radius_get_attr($rad)) {
if ($rad_attr['attr'] == $attribute) {
$rad_groups[] = radius_cvt_string($rad_attr['data']);
//r($rad_attr);
//break;
}
}
//r($rad_groups);
foreach ($rad_groups as $rad_group) {
if (isset($config['auth_radius_groups'][$rad_group]) && $config['auth_radius_groups'][$rad_group]['level'] > $rad_userlevel) {
$rad_userlevel = intval($config['auth_radius_groups'][$rad_group]['level']);
}
}
$cache['radius']['level'][$username] = $rad_userlevel;
} else {
$rad_userlevel = $cache['radius']['level'][$username];
}
} else {
// Old non-groups, by default always user level 10
if (strlen($username) > 0) {
$rad_userlevel = 10;
}
}
//r($rad_userlevel);
return $rad_userlevel;
}
