ruby-radius 1.1

data/README

@@ -0,0 +1,37 @@
+= Ruby-Radius - RADIUS interface for Ruby
+
+This Ruby module provides an interface to the RADIUS protocol.  It
+provides these two classes:
+
++Radius::Packet+:: Deals with Radius Packets
++Radius::Dictionary+:: - Deals with RADIUS dictionaries
+
+This module's API is based heavily on the Net::Radius Perl module
+created by Christopher Masto, Luis Munoz, and Ian Smith.
+
+== Installation
+
+Since the module is pure Ruby, to install this all that needs to be
+done is to run the 'install.rb' script.
+
+This package supports the use of vendor-specific attributes.  This
+type of attribute is defined in RFC 2138 and is used to support
+'proprietary' extensions on top of the base RADIUS specification.
+
+The whole API is documented in rdoc-style comments within the source
+itself.  If you have extracted this from a distribution tarball, the
+documentation should be included ready for you to read within the
+'doc' subdirectory.  If you've gotten this from CVS, you need rdoc to
+extract the HTML documentation.  Visit the rdoc website at
+http://rdoc.sourceforge.net/ for more information.
+
+= Other stuff
+Author::   Rafael 'Dido' Sevilla <dido@imperium.ph>
+Requires:: Ruby 1.6.7 or later (may work with older versions)
+License::  Copyright (c) 2002 Rafael R. Sevilla
+	   GNU Lesser General Public License, see the file COPYING.LIB
+           for more details.
+
+All of the test and example programs are placed in the public domain.
+
+$Id: README 2 2006-12-17 06:16:21Z dido $

data/dictionary

@@ -0,0 +1,289 @@
+#
+#	This file contains dictionary translations for parsing
+#        requests and generating responses.  All transactions are
+#        composed of Attribute/Value Pairs.  The value of each attribute
+#        is specified as one of 4 data types.  Valid data types are:
+#
+#        string - 0-253 octets
+#        ipaddr - 4 octets in network byte order
+#        integer - 32 bit value in big endian order (high byte first)
+#        date - 32 bit value in big endian order - seconds since
+#                                        00:00:00 GMT,  Jan.  1,         1970
+#
+#        Enumerated values are stored in the user file with dictionary
+#        VALUE translations for easy administration.
+#
+#        Example:
+#
+#        ATTRIBUTE          VALUE
+#        ---------------          -----
+#        Framed-Protocol = PPP
+#        7                = 1        (integer encoding)
+#
+
+
+
+#
+# Proper names for everything - use this instead of the above
+#
+ATTRIBUTE        User-Name                1        string
+ATTRIBUTE        User-Password                2        string
+ATTRIBUTE        CHAP-Password                3        string
+ATTRIBUTE        NAS-IP-Address                4        ipaddr
+ATTRIBUTE        NAS-Port                5        integer
+ATTRIBUTE        Service-Type                6        integer
+ATTRIBUTE        Framed-Protocol                7        integer
+ATTRIBUTE        Framed-IP-Address        8        ipaddr
+ATTRIBUTE        Framed-IP-Netmask        9        ipaddr
+ATTRIBUTE        Framed-Routing                10        integer
+ATTRIBUTE        Filter-Id                11        string
+ATTRIBUTE        Framed-MTU                12        integer
+ATTRIBUTE        Framed-Compression        13        integer
+ATTRIBUTE        Login-IP-Host                14        ipaddr
+ATTRIBUTE        Login-Service                15        integer
+ATTRIBUTE        Login-TCP-Port                16        integer
+ATTRIBUTE        Reply-Message                18        string
+ATTRIBUTE        Callback-Number                19        string
+ATTRIBUTE        Callback-Id                20        string
+ATTRIBUTE        Expiration                21        date
+ATTRIBUTE        Framed-Route                22        string
+ATTRIBUTE        Framed-IPX-Network        23        ipaddr
+ATTRIBUTE        State                        24        string
+ATTRIBUTE       Class                   25      octets
+ATTRIBUTE       Vendor-Specific         26      octets
+ATTRIBUTE        Session-Timeout                27        integer
+ATTRIBUTE        Idle-Timeout                28        integer
+ATTRIBUTE        Termination-Action        29        integer
+ATTRIBUTE        Called-Station-Id        30        string
+ATTRIBUTE        Calling-Station-Id        31        string
+ATTRIBUTE       NAS-Identifier          32      string
+ATTRIBUTE       Proxy-State                             33      octets
+ATTRIBUTE       Login-LAT-Service                       34      string
+ATTRIBUTE       Login-LAT-Node                          35      string
+ATTRIBUTE       Login-LAT-Group                         36      octets
+ATTRIBUTE       Framed-AppleTalk-Link                   37      integer
+ATTRIBUTE       Framed-AppleTalk-Network                38      integer
+ATTRIBUTE       Framed-AppleTalk-Zone                   39      string
+ATTRIBUTE        Acct-Status-Type        40        integer
+ATTRIBUTE        Acct-Delay-Time                41        integer
+ATTRIBUTE        Acct-Input-Octets        42        integer
+ATTRIBUTE        Acct-Output-Octets        43        integer
+ATTRIBUTE        Acct-Session-Id                44        string
+ATTRIBUTE        Acct-Authentic                45        integer
+ATTRIBUTE        Acct-Session-Time        46        integer
+ATTRIBUTE        Acct-Input-Packets              47     integer
+ATTRIBUTE        Acct-Ouput-Packets              48     integer
+ATTRIBUTE        Acct-Terminate-Cause        49        integer
+ATTRIBUTE      	Event-Timestamp		         	55       	date
+ATTRIBUTE        NAS-Port-Type                61        integer
+ATTRIBUTE        Port-Limit                62        integer
+
+ATTRIBUTE       CHAP-Challenge          60      octets
+ATTRIBUTE       Login-LAT-Port          63      string
+
+
+ATTRIBUTE       ARAP-Password                           70      octets  # 16 octets of data
+ATTRIBUTE       ARAP-Features                           71      octets  # 14 octets of data
+ATTRIBUTE       ARAP-Zone-Access                        72      integer
+ATTRIBUTE       ARAP-Security                           73      integer
+ATTRIBUTE       ARAP-Security-Data                      74      string
+ATTRIBUTE       Password-Retry                          75      integer
+ATTRIBUTE       Prompt                                  76      integer
+ATTRIBUTE       Connect-Info                            77      string
+ATTRIBUTE       Configuration-Token                     78      string
+ATTRIBUTE       EAP-Message                             79      octets
+ATTRIBUTE       Message-Authenticator                   80      octets
+
+ATTRIBUTE       ARAP-Challenge-Response                 84      octets  # 8 octets of data
+ATTRIBUTE       Acct-Interim-Interval                   85      integer
+# 86: RFC 2867
+ATTRIBUTE       NAS-Port-Id                             87      string
+ATTRIBUTE       Framed-Pool                             88      string
+
+
+#
+#        Integer Translations
+#
+
+#       Service types
+VALUE   Service-Type                    Login-User              1
+VALUE   Service-Type                    Framed-User             2
+VALUE   Service-Type                    Callback-Login-User     3
+VALUE   Service-Type                    Callback-Framed-User    4
+VALUE   Service-Type                    Outbound-User           5
+VALUE   Service-Type                    Administrative-User     6
+VALUE   Service-Type                    NAS-Prompt-User         7
+VALUE   Service-Type                    Authenticate-Only       8
+VALUE   Service-Type                    Callback-NAS-Prompt     9
+VALUE   Service-Type                    Call-Check              10
+VALUE   Service-Type                    Callback-Administrative 11
+
+#        Framed Protocols
+
+VALUE                Framed-Protocol                PPP                        1
+VALUE                Framed-Protocol                SLIP                        2
+
+#        Framed Routing Values
+
+VALUE                Framed-Routing                None                        0
+VALUE                Framed-Routing                Broadcast                1
+VALUE                Framed-Routing                Listen                        2
+VALUE                Framed-Routing                Broadcast-Listen        3
+
+#        Framed Compression Types
+
+VALUE                Framed-Compression        None                        0
+VALUE                Framed-Compression        Van-Jacobson-TCP-IP        1
+
+#        Login Services
+
+VALUE                Login-Service                Telnet                        0
+VALUE                Login-Service                Rlogin                        1
+VALUE                Login-Service                TCP-Clear                2
+VALUE                Login-Service                PortMaster                3
+
+#        Status Types
+
+VALUE                Acct-Status-Type        Start                        1
+VALUE                Acct-Status-Type        Stop                        2
+VALUE                Acct-Status-Type        Interim-Update              3
+
+#        Authentication Types
+
+VALUE                Acct-Authentic                RADIUS                        1
+VALUE                Acct-Authentic                Local                        2
+VALUE                Acct-Authentic                PowerLink128                100
+
+#        Termination Options
+
+VALUE                Termination-Action        Default                        0
+VALUE                Termination-Action        RADIUS-Request                1
+
+#        NAS Port Types, available in ComOS 3.3.1 and later
+
+VALUE                NAS-Port-Type                Async                        0
+VALUE                NAS-Port-Type                Sync                        1
+VALUE                NAS-Port-Type                ISDN                        2
+VALUE                NAS-Port-Type                ISDN-V120                3
+VALUE                NAS-Port-Type                ISDN-V110                4
+
+#        Acct Terminate Causes, available in ComOS 3.3.2 and later
+
+VALUE                Acct-Terminate-Cause        User-Request                1
+VALUE                Acct-Terminate-Cause        Lost-Carrier                2
+VALUE                Acct-Terminate-Cause        Lost-Service                3
+VALUE                Acct-Terminate-Cause        Idle-Timeout                4
+VALUE                Acct-Terminate-Cause        Session-Timeout                5
+VALUE                Acct-Terminate-Cause        Admin-Reset                6
+VALUE                Acct-Terminate-Cause        Admin-Reboot                7
+VALUE                Acct-Terminate-Cause        Port-Error                8
+VALUE                Acct-Terminate-Cause        NAS-Error                9
+VALUE                Acct-Terminate-Cause        NAS-Request                10
+VALUE                Acct-Terminate-Cause        NAS-Reboot                11
+VALUE                Acct-Terminate-Cause        Port-Unneeded                12
+VALUE                Acct-Terminate-Cause        Port-Preempted                13
+VALUE                Acct-Terminate-Cause        Port-Suspended                14
+VALUE                Acct-Terminate-Cause        Service-Unavailable        15
+VALUE                Acct-Terminate-Cause        Callback                16
+VALUE                Acct-Terminate-Cause        User-Error                17
+VALUE                Acct-Terminate-Cause        Host-Request                18
+
+
+#
+# Obsolete names for backwards compatibility with older users files
+# If you want RADIUS accounting logs to use the new names instead of
+# these, move this section to the beginning of the dictionary file
+# and kill and restart radiusd
+# If you don't have a RADIUS 1.16 users file that you're still using,
+# you can delete or ignore this section.
+#
+ATTRIBUTE        Client-Id                4        ipaddr
+ATTRIBUTE        Client-Port-Id                5        integer
+ATTRIBUTE        User-Service-Type        6        integer
+ATTRIBUTE        Framed-Address                8        ipaddr
+ATTRIBUTE        Framed-Netmask                9        ipaddr
+ATTRIBUTE        Framed-Filter-Id        11        string
+ATTRIBUTE        Login-Host                14        ipaddr
+ATTRIBUTE        Login-Port                16        integer
+ATTRIBUTE        Old-Password                17        string
+ATTRIBUTE        Port-Message                18        string
+ATTRIBUTE        Dialback-No                19        string
+ATTRIBUTE        Dialback-Name                20        string
+ATTRIBUTE        Challenge-State                24        string
+VALUE                Service-Type                Dialback-Login-User        3
+VALUE                Service-Type                Dialback-Framed-User        4
+VALUE                Service-Type                Shell-User                6
+VALUE                Framed-Compression        Van-Jacobsen-TCP-IP        1
+#VALUE                Auth-Type                Unix                        1
+#
+# END of obsolete names for backwards compatibility
+#
+
+#
+#        Configuration Values
+#        uncomment out these two lines to turn account expiration on
+#
+
+#VALUE                Server-Config                Password-Expiration        30
+#VALUE                Server-Config                Password-Warning        5
+
+##
+## VENDOR SPECIFIC ATTRIBUTES
+##
+## The following entries demonstrate the use of VSAs
+##
+
+# cisco-avpair is used for various functions by cisco IOS. Most
+# notably, it's used to create VPDN tunnels.
+#
+VENDORATTR        9        cisco-avpair        1        string
+
+# Symbol attributes
+
+# Access request attribute's
+VENDORATTR 388	Symbol-Service-Type		1	integer
+# SSID in the access request
+VENDORATTR 388	Symbol-Wlan-Index		2	string
+# Wlan index in the Access Request, deprecated in WING 5.0, this check item is replaced by VSA - Symbol-Allowed-ESSID
+VENDORATTR 388	Symbol-Attr-4		4	string
+VENDORATTR 388	Symbol-Allowed-ESSID    3	string
+# Reply Attribute which sends the expiry date & time for the guest users
+VENDORATTR 388	Guest-User-Expiry-Date-Time		7	string
+# Reply Attribute which sends the start date & time for the guest users
+VENDORATTR 388	Guest-User-Start-Date-Time		8	string
+# Rate Limit Parameters
+VENDORATTR 388	Symbol-Downlink-Limit-Kbps		10	integer
+VENDORATTR 388	Symbol-Uplink-Limit-Kbps		11	integer
+# User group name
+VENDORATTR 388	Symbol-User-Group		12	string
+VENDORATTR 388	Symbol-User-Device-Type		13	string
+VENDORATTR 388	Symbol-User-OS			14	string
+VENDORATTR 388	Symbol-User-Browser		15	string
+VENDORATTR 388	Symbol-Login-Service		100	integer
+
+# Aruba attributes
+
+VENDORATTR 14823 Aruba-User-Role 1 string
+VENDORATTR 14823 Aruba-User-Vlan 2 integer
+VENDORATTR 14823 Aruba-Priv-Admin-User 3 integer
+VENDORATTR 14823 Aruba-Admin-Role 4 string
+VENDORATTR 14823 Aruba-Essid-Name 5 string
+VENDORATTR 14823 Aruba-Location-Id 6 string
+VENDORATTR 14823 Aruba-Port-Id 7 string
+VENDORATTR 14823 Aruba-Template-User 8 string
+VENDORATTR 14823 Aruba-Named-User-Vlan 9 string
+VENDORATTR 14823 Aruba-AP-Group 10 string
+VENDORATTR 14823 Aruba-Framed-IPv6-Address 11 string
+
+# Airespace attributes
+VENDORATTR 14179       Airespace-Wlan-Id                       1       integer
+VENDORATTR 14179       Airespace-QOS-Level                     2       integer
+VENDORATTR 14179       Airespace-DSCP                          3       integer
+VENDORATTR 14179       Airespace-8021p-Tag                     4       integer
+VENDORATTR 14179       Airespace-Interface-Name                5       string
+VENDORATTR 14179       Airespace-ACL-Name                      6       string
+
+VENDORVALUE   14179 Airespace-QOS-Level             Bronze                  3
+VENDORVALUE   14179 Airespace-QOS-Level             Silver                  0
+VENDORVALUE   14179 Airespace-QOS-Level             Gold                    1
+VENDORVALUE   14179 Airespace-QOS-Level             Platinum                2

data/examples/radiusclient.rb

@@ -0,0 +1,51 @@
+#!/usr/local/bin/ruby
+#
+# Sample RADIUS client
+#
+# This code is provided for illustrative purposes only and is placed
+# in the public domain.
+#
+# $Id: radiusclient.rb 2 2006-12-17 06:16:21Z dido $
+#
+require 'radius/dictionary'
+require 'radius/packet'
+require 'socket'
+
+user = 'test'
+pass = 'test'
+authhost = '127.0.0.1';
+authport = '1812';
+secret = 'h1dd3n';
+dictfile = "../dictionary"
+
+dict = Radius::Dict.new
+File.open(dictfile) {
+  |fn|
+  dict.read(fn)
+}
+
+def bigrand()
+    return([rand(65536), rand(65536), rand(65536), rand(65536), 
+	     rand(65536), rand(65536), rand(65536), rand(65536)].pack("n8"))
+end
+
+ident = 170;
+req = Radius::Packet.new(dict)
+req.code = 'Access-Request'
+req.identifier = ident
+req.authenticator = bigrand()
+req.set_attr('NAS-IP-Address', '127.0.0.1')
+req.set_attr('User-Name', user)
+req.set_password(pass, secret)
+print req.to_s(nil) + "\n"
+p = req.pack
+print p.unpack("H*"), "\n"
+print "Socket connecting\n"
+sock = UDPSocket.open
+sock.connect(authhost, authport)
+print "Socket sending\n"
+sock.send(p, 0)
+rec = sock.recvfrom(65536)
+resp = Radius::Packet.new(dict)
+resp.unpack(rec[0])
+print resp.to_s(nil)

data/examples/rclient.rb

@@ -0,0 +1,24 @@
+#!/usr/local/bin/ruby
+#
+# Sample RADIUS client using the new Radius::Auth class
+#
+# This code is provided for illustrative purposes only and is placed
+# in the public domain.
+#
+# $Id: rclient.rb 2 2006-12-17 06:16:21Z dido $
+#
+require 'radius/auth'
+
+auth = Radius::Auth.new('../dictionary', '127.0.0.1', 5)
+secret = 'h1dd3n'
+print "login: "
+user = $stdin.readline
+user.chomp!
+print "Password: "
+pass = $stdin.readline
+pass.chomp!
+if (auth.check_passwd(user, pass, secret, '127.0.0.1'))
+  print "Authentication successful.\n"
+else
+  print "Authentication failed.\n"
+end

data/lib/radius/auth.rb

@@ -0,0 +1,131 @@
+# RADIUS authenticator
+#  Copyright (C) 2002 Rafael R. Sevilla <dido@imperium.ph>
+#  This file is part of the Radius Authentication Module for Ruby
+#
+#  The Radius Authentication Module for Ruby is free software; you can
+#  redistribute it and/or modify it under the terms of the GNU Lesser
+#  General Public License as published by the Free Software
+#  Foundation; either version 2.1 of the License, or (at your option)
+#  any later version.
+#
+#  The Radius Authentication Module is distributed in the hope that it
+#  will be useful, but WITHOUT ANY WARRANTY; without even the implied
+#  warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+#  See the GNU Lesser General Public License for more details.
+#
+#  You should have received a copy of the GNU Lesser General Public
+#  License along with the GNU C Library; if not, write to the Free
+#  Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
+#  02111-1307 USA.
+#
+# Author:: Rafael R. Sevilla (mailto:dido@imperium.ph)
+# Copyright:: Copyright (c) 2002 Rafael R. Sevilla
+# License:: GNU Lesser General Public License
+# $Id: auth.rb 2 2006-12-17 06:16:21Z dido $
+#
+
+module Radius
+  require 'radius/packet'
+  require 'radius/dictionary'
+  require 'socket'
+
+  class Auth
+    # We can inspect and alter the contents of the internal RADIUS
+    # packet here (although this is probably not required for simple
+    # work)
+    attr_reader :packet
+
+    # This method initializes the Auth object, given a dictionary
+    # filename to read, the RADIUS host[:port] to connect to, and a
+    # timeout value in seconds for the connection.
+    # =====Parameters
+    # +dictfilename+:: Dictionary filename to read
+    # +radhost+:: name of RADIUS server optionally followed by port number
+    # +myip+:: the client's own IP address (NAS IP address)
+    # +timeout+:: Timeout time
+    def initialize(radhost, myip, timeout, dictfilename = File.dirname(__FILE__) + "/../../dictionary")
+      @dict = Radius::Dictionary.new
+      if dictfilename != nil
+        File.open(dictfilename) do |fn|
+          @dict.read(fn)
+        end
+      end
+      @packet = Radius::Packet.new(@dict)
+
+      # this is probably better than starting identifiers at 0
+      @packet.identifier = Kernel.rand(65535)
+      @myip = myip
+      @host, @port = radhost.split(":")
+      @port = Socket.getservbyname("radius", "udp") unless @port
+      @port = 1812 unless @port
+      @port = @port.to_i	# just in case
+      @timeout = timeout
+      @sock = UDPSocket.open
+      @sock.connect(@host, @port)
+    end
+
+    # Verifies a username/password pair against the RADIUS server
+    # associated with the Auth object.
+    #
+    # =====Parameters
+    # +name+:: The user name to verify
+    # +pwd+:: The password associated with this name
+    # +secret+:: The RADIUS secret of the system
+    # =====Return value
+    # returns true or false depending on whether or not the attempt succeeded or failed.
+    def check_passwd(name, pwd, secret)
+      send_check_passwd(name, pwd, secret)
+      recv_check_passwd
+    end
+
+    def send_check_passwd(name, pwd, secret)
+      @packet.code = 'Access-Request'
+      gen_authenticator
+      @packet.set_attr('User-Name', name)
+      @packet.set_attr('NAS-IP-Address', @myip)
+      @packet.set_password(pwd, secret)
+      send_packet
+    end
+
+    def recv_check_passwd
+      recv_packet
+      return(@packet.code == 'Access-Accept')
+    end
+
+    # Generate an authenticator, placing it in the @packet object's
+    # authenticator attribute.  It will try to use /dev/urandom if
+    # possible, or the system rand call if that's not available.
+    def gen_authenticator
+      # get authenticator data from /dev/urandom if possible
+      if (File.exist?("/dev/urandom"))
+        File.open("/dev/urandom") do |urandom|
+          @packet.authenticator = urandom.read(16)
+        end
+      else
+        # use the Kernel:rand method.  This is quite probably not
+        # as secure as using /dev/urandom, be wary...
+        @packet.authenticator = [rand(65536), rand(65536), rand(65536),
+          rand(65536), rand(65536), rand(65536), rand(65536),
+          rand(65536)].pack("n8")
+      end
+      return(@packet.authenticator)
+    end
+
+    # Sends a packet to the server via UDP.
+    def send_packet
+      data = @packet.pack
+      @packet.identifier = (@packet.identifier + 1) & 0xff
+      @sock.send(data, 0)
+    end
+
+    # Receive a packet from the server via UDP.
+    def recv_packet
+      if select([@sock], nil, nil, @timeout) == nil
+        raise "Timed out waiting for response packet from server"
+      end
+      data = @sock.recvfrom(65536)
+      @packet.unpack(data[0])
+      return(@packet)
+    end
+  end
+end