Пример #1
0
 /**
  * Reads all received attributes after sending the request.
  *
  * This methods stores known attributes in the property attributes,
  * all attributes (including known attibutes) are stored in rawAttributes
  * or rawVendorAttributes.
  * NOTE: call this function also even if the request was rejected, because the
  * Server returns usualy an errormessage
  *
  * @access public
  * @return bool   true on success, false on error
  */
 function getAttributes()
 {
     while ($attrib = radius_get_attr($this->res)) {
         if (!is_array($attrib)) {
             return false;
         }
         $attr = $attrib['attr'];
         $data = $attrib['data'];
         $this->rawAttributes[$attr] = $data;
         switch ($attr) {
             case RADIUS_FRAMED_IP_ADDRESS:
                 $this->attributes['framed_ip'] = radius_cvt_addr($data);
                 break;
             case RADIUS_FRAMED_IP_NETMASK:
                 $this->attributes['framed_mask'] = radius_cvt_addr($data);
                 break;
             case RADIUS_FRAMED_MTU:
                 $this->attributes['framed_mtu'] = radius_cvt_int($data);
                 break;
             case RADIUS_FRAMED_COMPRESSION:
                 $this->attributes['framed_compression'] = radius_cvt_int($data);
                 break;
             case RADIUS_SESSION_TIMEOUT:
                 $this->attributes['session_timeout'] = radius_cvt_int($data);
                 break;
             case RADIUS_IDLE_TIMEOUT:
                 $this->attributes['idle_timeout'] = radius_cvt_int($data);
                 break;
             case RADIUS_SERVICE_TYPE:
                 $this->attributes['service_type'] = radius_cvt_int($data);
                 break;
             case RADIUS_CLASS:
                 $this->attributes['class'] = radius_cvt_string($data);
                 break;
             case RADIUS_FRAMED_PROTOCOL:
                 $this->attributes['framed_protocol'] = radius_cvt_int($data);
                 break;
             case RADIUS_FRAMED_ROUTING:
                 $this->attributes['framed_routing'] = radius_cvt_int($data);
                 break;
             case RADIUS_FILTER_ID:
                 $this->attributes['filter_id'] = radius_cvt_string($data);
                 break;
             case RADIUS_REPLY_MESSAGE:
                 $this->attributes['reply_message'] = radius_cvt_string($data);
                 break;
             case RADIUS_VENDOR_SPECIFIC:
                 $attribv = radius_get_vendor_attr($data);
                 if (!is_array($attribv)) {
                     return false;
                 }
                 $vendor = $attribv['vendor'];
                 $attrv = $attribv['attr'];
                 $datav = $attribv['data'];
                 $this->rawVendorAttributes[$vendor][$attrv] = $datav;
                 if ($vendor == RADIUS_VENDOR_MICROSOFT) {
                     switch ($attrv) {
                         case RADIUS_MICROSOFT_MS_CHAP2_SUCCESS:
                             $this->attributes['ms_chap2_success'] = radius_cvt_string($datav);
                             break;
                         case RADIUS_MICROSOFT_MS_CHAP_ERROR:
                             $this->attributes['ms_chap_error'] = radius_cvt_string(substr($datav, 1));
                             break;
                         case RADIUS_MICROSOFT_MS_CHAP_DOMAIN:
                             $this->attributes['ms_chap_domain'] = radius_cvt_string($datav);
                             break;
                         case RADIUS_MICROSOFT_MS_MPPE_ENCRYPTION_POLICY:
                             $this->attributes['ms_mppe_encryption_policy'] = radius_cvt_int($datav);
                             break;
                         case RADIUS_MICROSOFT_MS_MPPE_ENCRYPTION_TYPES:
                             $this->attributes['ms_mppe_encryption_types'] = radius_cvt_int($datav);
                             break;
                         case RADIUS_MICROSOFT_MS_CHAP_MPPE_KEYS:
                             $demangled = radius_demangle($this->res, $datav);
                             $this->attributes['ms_chap_mppe_lm_key'] = substr($demangled, 0, 8);
                             $this->attributes['ms_chap_mppe_nt_key'] = substr($demangled, 8, RADIUS_MPPE_KEY_LEN);
                             break;
                         case RADIUS_MICROSOFT_MS_MPPE_SEND_KEY:
                             $this->attributes['ms_chap_mppe_send_key'] = radius_demangle_mppe_key($this->res, $datav);
                             break;
                         case RADIUS_MICROSOFT_MS_MPPE_RECV_KEY:
                             $this->attributes['ms_chap_mppe_recv_key'] = radius_demangle_mppe_key($this->res, $datav);
                             break;
                         case RADIUS_MICROSOFT_MS_PRIMARY_DNS_SERVER:
                             $this->attributes['ms_primary_dns_server'] = radius_cvt_string($datav);
                             break;
                     }
                 }
                 break;
         }
     }
     return true;
 }
Пример #2
0
                        case RADIUS_MICROSOFT_MS_CHAP_MPPE_KEYS:
                            $demangled = radius_demangle($res, $datav);
                            $lmkey = substr($demangled, 0, 8);
                            $ntkey = substr($demangled, 8, RADIUS_MPPE_KEY_LEN);
                            printf("MS MPPE Keys: LM-Key: %s NT-Key: %s<br>\n", bin2hex($lmkey), bin2hex($ntkey));
                            break;
                        case RADIUS_MICROSOFT_MS_MPPE_SEND_KEY:
                            $demangled = radius_demangle_mppe_key($res, $datav);
                            printf("MS MPPE Send Key: %s<br>\n", bin2hex($demangled));
                            break;
                        case RADIUS_MICROSOFT_MS_MPPE_RECV_KEY:
                            $demangled = radius_demangle_mppe_key($res, $datav);
                            printf("MS MPPE Send Key: %s<br>\n", bin2hex($demangled));
                            break;
                        case RADIUS_MICROSOFT_MS_PRIMARY_DNS_SERVER:
                            $server = radius_cvt_string($datav);
                            printf("MS Primary DNS Server: %s<br>\n", $server);
                            break;
                        default:
                            printf("Unexpected Microsoft attribute: %d<br>\n", $attrv);
                    }
                }
            } else {
                printf("Error getting Vendor attribute %s<br>\n", radius_strerror($res));
            }
            break;
        default:
            printf("Unexpected attribute: %d<br>\n", $attr);
    }
}
$secret = radius_server_secret($res);
Пример #3
0
 /**
  *	Validate login credentials
  *
  *	@param string $uname - The user name requesting access
  *	@param string $pass - Password to use (usually plain text)
  *	@param pointer &$newvals - pointer to array to accept other data read from database
  *	@param boolean $connect_only - TRUE to simply connect to the server
  *
  *	@return integer result (AUTH_xxxx)
  *
  *	On a successful login, &$newvals array is filled with the requested data from the server
  */
 function login($uname, $pass, &$newvals, $connect_only = FALSE)
 {
     // Create authentification request
     if (!radius_create_request($this->connection, RADIUS_ACCESS_REQUEST)) {
         $this->makeErrorText('RADIUS failed authentification request: ');
         return AUTH_NOCONNECT;
     }
     if (trim($pass) == '') {
         return AUTH_BADPASSWORD;
     }
     // Pick up a blank password - always expect one
     // Attach username and password
     if (!radius_put_attr($this->connection, RADIUS_USER_NAME, $uname) || !radius_put_attr($this->connection, RADIUS_USER_PASSWORD, $pass)) {
         $this->makeErrorText('RADIUS could not attach username/password: '******'CHAP not supported');
             return AUTH_NOUSER;
         case RADIUS_ACCESS_REJECT:
             // Specifically rejected
         // Specifically rejected
         default:
             // Catch-all
             $this->makeErrorText('RADIUS validation error: ');
             return AUTH_NOUSER;
     }
     // User accepted here.
     if ($connect_only) {
         return AUTH_SUCCESS;
     }
     return AUTH_SUCCESS;
     // Not interested in any attributes returned ATM, so done.
     // See if we get any attributes - not really any use to us unless we implement CHAP, so disabled ATM
     $attribs = array();
     while ($resa = radius_get_attr($this->connection)) {
         if (!is_array($resa)) {
             $this->makeErrorText("Error getting attribute: ");
             exit;
         }
         //			Decode attribute according to type (this isn't an exhaustive list)
         //		Codes: 2, 3, 4, 5, 30, 31, 32, 60, 61 should never be received by us
         //		Codes 17, 21 not assigned
         switch ($resa['attr']) {
             case 8:
                 // IP address to be set (255.255.255.254 indicates 'allocate your own address')
             // IP address to be set (255.255.255.254 indicates 'allocate your own address')
             case 9:
                 // Subnet mask
             // Subnet mask
             case 14:
                 // Login-IP host
                 $attribs[$resa['attr']] = radius_cvt_addr($resa['data']);
                 break;
             case 6:
                 // Service type  (integer bitmap)
             // Service type  (integer bitmap)
             case 7:
                 // Protocol (integer bitmap)
             // Protocol (integer bitmap)
             case 10:
                 // Routing method (integer)
             // Routing method (integer)
             case 12:
                 // Framed MTU
             // Framed MTU
             case 13:
                 // Compression method
             // Compression method
             case 15:
                 // Login service (bitmap)
             // Login service (bitmap)
             case 16:
                 // Login TCP port
             // Login TCP port
             case 23:
                 // Framed IPX network (0xFFFFFFFE indicates 'allocate your own')
             // Framed IPX network (0xFFFFFFFE indicates 'allocate your own')
             case 27:
                 // Session timeout - maximum connection/login time in seconds
             // Session timeout - maximum connection/login time in seconds
             case 28:
                 // Idle timeout in seconds
             // Idle timeout in seconds
             case 29:
                 // Termination action
             // Termination action
             case 37:
                 // AppleTalk link number
             // AppleTalk link number
             case 38:
                 // AppleTalk network
             // AppleTalk network
             case 62:
                 // Max ports
             // Max ports
             case 63:
                 // Login LAT port
                 $attribs[$resa['attr']] = radius_cvt_int($resa['data']);
                 break;
             case 1:
                 // User name
             // User name
             case 11:
                 // Filter ID - could get several of these
             // Filter ID - could get several of these
             case 18:
                 // Reply message (text, various purposes)
             // Reply message (text, various purposes)
             case 19:
                 // Callback number
             // Callback number
             case 20:
                 // Callback ID
             // Callback ID
             case 22:
                 // Framed route - could get several of these
             // Framed route - could get several of these
             case 24:
                 // State - used in CHAP
             // State - used in CHAP
             case 25:
                 // Class
             // Class
             case 26:
                 // Vendor-specific
             // Vendor-specific
             case 33:
                 // Proxy State
             // Proxy State
             case 34:
                 // Login LAT service
             // Login LAT service
             case 35:
                 // Login LAT node
             // Login LAT node
             case 36:
                 // Login LAT group
             // Login LAT group
             case 39:
                 // AppleTalk zone
             // AppleTalk zone
             default:
                 $attribs[$resa['attr']] = radius_cvt_string($resa['data']);
                 // Default to string type
         }
         printf("Got Attr: %d => %d Bytes %s\n", $resa['attr'], strlen($attribs[$resa['attr']]), $attribs[$resa['attr']]);
     }
     return AUTH_SUCCESS;
 }
Пример #4
0
/**
 * Retrieve user auth level for specified user.
 *
 * @param string $username Username to retrieve the auth level for
 * @return int User's auth level
 */
function radius_auth_user_level($username)
{
    global $config, $rad, $cache;
    $rad_userlevel = 0;
    if (isset($config['auth_radius_groups'])) {
        // If groups set, try to search group attribute and set user level
        if (!isset($cache['radius']['level'][$username])) {
            if ($config['auth_radius_groupmemberattr'] == 18 || strtolower($config['auth_radius_groupmemberattr']) == 'reply-message') {
                // Reply-Message (18)
                $attribute = RADIUS_REPLY_MESSAGE;
            } else {
                // Filter-Id (11)
                $attribute = RADIUS_FILTER_ID;
            }
            $rad_groups = array();
            while ($rad_attr = radius_get_attr($rad)) {
                if ($rad_attr['attr'] == $attribute) {
                    $rad_groups[] = radius_cvt_string($rad_attr['data']);
                    //r($rad_attr);
                    //break;
                }
            }
            //r($rad_groups);
            foreach ($rad_groups as $rad_group) {
                if (isset($config['auth_radius_groups'][$rad_group]) && $config['auth_radius_groups'][$rad_group]['level'] > $rad_userlevel) {
                    $rad_userlevel = intval($config['auth_radius_groups'][$rad_group]['level']);
                }
            }
            $cache['radius']['level'][$username] = $rad_userlevel;
        } else {
            $rad_userlevel = $cache['radius']['level'][$username];
        }
    } else {
        // Old non-groups, by default always user level 10
        if (strlen($username) > 0) {
            $rad_userlevel = 10;
        }
    }
    //r($rad_userlevel);
    return $rad_userlevel;
}