13.2.12 Sample Radtest Program

As an example, let's consider radauth program (see section 12.6 radauth). Its main purpose is to send authentication request to the remote server, analyze its reply and if it is positive, send an appropriate accounting record, thereby initiating user's session. Optionally, the script should also be able to send a lone accounting record.

In the discussion below, we will show and explain subsequent parts of the script text. For the ease of explanation, each line of program text will be prepended by its ordinal line number.

Parsing command line options

The script begins as follows:

1 #! /usr/bin/radtest -f 2 3 while getopt "n:s:P:hv" 4 begin 5 case $OPTVAR in 6 "-n") NASIP = $OPTARG 7 "-s") SID = $OPTARG 8 "-P") PID = $OPTARG 9 "-v") set -v

1

It is a pragmatic comment informing shell that it should run radtest in order to interpret the program.

3

This line starts option processing loop. Getopt (see section getopt) in line 3 analyzes each subsequent command line argument and if it is an option checks whether it matches one of the option letters defined in its first argument. The option letter will be returned in OPTVAR variable, its argument (if any) -- in OPTARG variable.

4 -- 8

OPTARG value is analyzed using case statement. Lines 6 -- 8 preserve OPTARG values in appropriate variables for later use. NASIP will be used as the value of NAS-IP-Address attribute, SID is the session id (Acct-Session-Id attribute), and PID is the port number (for NAS-Port-Id attribute.

9

This line sets `-v' option to the radtest interpreter (see section 13.2.1 Invoking radtest).

The next piece of code handles `-h' and erroneous options:

10 "-h") begin 11 print <<-EOT 12 usage: radauth [OPTIONS] [COMMAND] login [password] 13 Options are: 14 -v Print verbose descriptions of what is being done 15 -n IP Set NAS IP address 16 -s SID Set session ID 17 -P PORT Set NAS port number 18 COMMAND is one of: 19 auth Send only Access-Request (default) 20 acct Send Access-Request. If successfull, send 21 accounting start request 22 start Send accounting start request 23 stop Send accounting stop request 24 EOT 25 exit 0 26 end 27 ".*") begin 28 print "Unknown option: " $OPTVAR "\n" 29 exit 1 30 end 31 end 32 end

10 -- 26

Print short description and exit, if the program is given `-h'. Notice that `here document' syntax is used to print the text (See section 13.2.2.2 Character Strings, for its description). The leading whitespace in lines 12 to 24 is composed of tabulation characters (ASCII 9), not usual space characters (ASCII 32), as required by `<<-' construct.

27 -- 30

These lines handle unrecognized options.

31

Closes case statement started on line 5

32

Closes compound statement started on line 4

Checking Command Line Consistency

33 34 shift ${OPTIND}-1 35 36 if $# > 3 37 begin 38 print "Wrong number of arguments." 39 print "Try radauth -h for more info" 40 exit 1 41 end

34

OPTIND keeps the ordinal number of the first non-optional argument. This line shifts off all the options processed by getopt, so that the first non-optional argument may be addressed by $1 notation. Notice use of curly braces to solve minus ambiguity (see minus-ambiguity).

36 -- 41

At this point we may have at most three arguments: command, user name, and password. If there are more, display the diagnostic message and exit the program.

Next piece of code:

42 43 case $1 in 44 "auth|acct|start|stop") begin 45 COMMAND=$1 46 shift 1 47 end 48 ".*") COMMAND="auth" 49 end 50 51 LOGIN=${1:?User name is not specified. Try radauth -h for more info.} 52 53 if ${NASIP:-} = "" 54 NASIP=$SOURCEIP 55 56 LIST = ( User-Name = $LOGIN NAS-IP-Address = $NASIP )

43 -- 48

Check if a command is given. If so, store command name in the variable COMMAND and shift arguments by one, so login becomes argument $1. Otherwise, assume `auth' command.

51

If the user login name is supplied, store it into LOGIN variable. Otherwise, print diagnostic message and exit.

53 -- 54

Provide a default value for NASIP variable from the built-in variable SOURCEIP (see section 13.2.4.6 Built-in Variables)

56

The variable LIST will hold the list of A/V pairs to be sent to the server. This line initializes it with a list of two A/V pairs: User-Name and NAS-IP-Address.

Defining Accounting Function

Accounting function will be used to send accounting requests to the server. It is supposed to take a single argument: an avlist of A/V pairs to be sent to the server.

57 58 'acct' 59 begin 60 if ${SID:-} = "" 61 input "Enter session ID: " SID 62 if ${PID:-} = "" 63 input "Enter NAS port ID: " PID 64 send auth Accounting-Request $1 + \ (Acct-Session-Id = $SID NAS-Port-Id = $PID)

58 -- 59

These lines start the function definition. Notice quoting of the function name (`acct'): it is necessary because it coincides with a reserved keyword (see section 13.2.3 Reserved Keywords).

60 -- 61

If the value of SID (session ID) is not supplied, prompt the user to input it.

62 -- 63

If the value of PID (port ID) is not supplied, prompt the user to input it.

64

Send accounting request. The list of A/V pairs to send is formed by concatenating Acct-Session-Id and NAS-Port-Id attributes to the function's first argument.

The final part of acct function analyzes the reply from the server:

65 if $REPLY_CODE != Accounting-Response 66 begin 67 print "Accounting failed.\n" 68 exit 1 69 end 70 print "Accounting OK.\n" 71 exit 0 72 end 73

Notice, that acct never returns. Instead it exits with an error code indicating success or failure.

Defining Authentication Function

The purpose of the authentication function auth is to send an Access-Request to the server and perform some actions based on its reply.

The function will take three arguments:

$1

The list of A/V pairs to include in the request.

$2

User password.

$3

This argument indicates whether accounting request must be sent after successful authentication. String `yes' means to send the accounting request, `no' means not to send it.

The function is not expected to return. Instead it should exit to the shell with an appropriate error code.

74 'auth' 75 begin 76 send auth Access-Request $1 + (User-Password = $2)

74 -- 75

Begin the function definition. Notice quoting of the function name (`auth'): it is necessary because it coincides with a reserved keyword (see section 13.2.3 Reserved Keywords).

76

Send the initial authentication request. The list of A/V pairs is formed by appending User-Password pair to the list given by the first argument to the function.

The rest of the function analyzes the reply from the server and takes appropriate actions. Notice that if the server replies with an Access-Challenge packet, we will have to send subsequent authentication requests, so this piece of code is enclosed within a while loop.

First, the function handles Access-Accept and Access-Reject replies:

77 while 1 78 begin 79 if $REPLY_CODE = Access-Accept 80 begin 81 print "Authentication passed. " + $REPLY[Reply-Message*] + "\n" 82 if ${3:-no} = no 83 exit 0 84 'acct'($1 + ( Acct-Status-Type = Start )) 85 end else if $REPLY_CODE = Access-Reject 86 begin 87 print "Authentication failed. " + $REPLY[Reply-Message*] + "\n" 88 break

77

Begin an "endless" while loop. It will eventually be exited either using break, or using exit (see below).

79 -- 84

Hanlde Access-Accept replies:

81

Print the reply message. Notice the use of `*' to print all the instances of Reply-Message attribute from the reply packet (see section 13.2.4.4 Accessing Elements of A/V Pair Lists).

82 -- 83

If the third argument is missing or is a string `no', exit indicating success (see section 13.2.4.3 Dereferencing Variables).

84

Otherwise, call acct function to perform accounting. The A/V pairs included in the accounting request are formed by adding Acct-Status-Type attribute to the list given by the first argument to the function.

85 -- 88

Handle Access-Reject replies. Print the reply message and break from the loop.

Next piece of code deals with Access-Challenge replies. For simplicity we assume that such replies always carry user menus (See section 5.13 Login Menus -- `raddb/menus', for the description of these). So, upon receiving an Access-Challenge we should print out the menu, read the users selection and send back an Access-Request to the server. This part is the only one that actually continues the loop at line 77.

89 end else if $REPLY_CODE = Access-Challenge 90 begin 91 print $REPLY[Reply-Message*] 92 input 93 send auth Access-Request \ 94 (User-Name = $LOGIN User-Password = $INPUT \ State = $REPLY[State])

91

Print the menu contents carrieb by Reply-Message attributes. There may be several instances of the attribute, hence the use of `*' to concatenate their values together.

92

Read the input from the user. The input will be stored in INPUT variable. See section 13.2.11 Built-in Primitives, for the description of input statement.

93 -- 94

Send an Access-Request packet with three attributes. User-Password contains the user reply, State contains the menu state from the server reply packet.

Final part of the function:

95 end else begin 96 print "Authentication failed. Reply code " + $REPLY_CODE + "\n" 97 break 98 end 99 end 100 exit 1 101 end 102

95 -- 98

Handle unknown reply codes.

99

Closes the while loop started on line 77.

100

Exit to the shell indicating failure. This statement will be reached only if a break is executed either on line 88 or on line 97.

101

Closes function definition started on lines 74 -- 75

Final Part of Radauth Program

The final part selects an action based on the user command and executes it. It is equivalent to the main function in a C program:

103 case ${COMMAND} in 104 "auth") 'auth'($LIST, ${2:&Password: }, no) 105 "acct") 'auth'($LIST, ${2:&Password: }, yes) 106 "start") 'acct'($LIST+(Acct-Status-Type = Start)) 107 "stop") 'acct'($LIST+(Acct-Status-Type = Stop)) 108 ".*") begin 109 print "Unknown command. Try radauth -h for more info" 110 exit 1 111 end 112 end 113 114 # End of radauth

103

Select an action based on the value of COMMAND variable.

104 -- 105

Call auth function. If the second argument is given in the command line, its value is taken as user's password. Otherwise, the user is prompted for the password with the string `Password: '. The input is read with echo turned off to prevent the password from being compromised (the `:&' construct, see section 13.2.4.3 Dereferencing Variables).

106 -- 107

Call acct function for `start' and stop commands.

108 -- 111

Handle an unknown command verb.

112

Closes case statement from line 103.