Added the configure option server-name

If set it will be used to set the NAS_IDENTIFIER in radius.

doc/sample.config

@@ -29,9 +29,9 @@
 
 #auth = "pam"
 #auth = "pam[gid-min=1000]"
-auth = "plain[./sample.passwd]"
+#auth = "plain[./sample.passwd]"
 #auth = "certificate"
-#auth = "radius[/etc/radiusclient/radiusclient.conf,groupconfig]"
+auth = "radius[/etc/radiusclient/radiusclient.conf,groupconfig]"
 
 # Specify alternative authentication methods that are sufficient
 # for authentication. That is, if set, any of the methods enabled
@@ -61,6 +61,9 @@ max-clients = 16
 # multiple times). Unset or set to zero for unlimited.
 max-same-clients = 2
 
+# Used to identify this particular server.
+server-name = ocserv@example.com
+
 # Use listen-host to limit to specific IPs or to the IPs of a provided 
 # hostname.
 #listen-host = [IP|HOSTNAME]

src/auth/gssapi.c

@@ -81,7 +81,7 @@ const gss_OID_set_desc desired_mechs = {
 	.elements = (gss_OID)&spnego_mech
 };
 
-static void gssapi_global_init(void *pool, void *additional)
+static void gssapi_global_init(void *pool, const char *server_name, void *additional)
 {
 	int ret;
 	OM_uint32 time, minor;

src/auth/plain.c

@@ -48,7 +48,7 @@ struct plain_ctx_st {
 
 static char *password_file = NULL;
 
-static void plain_global_init(void *pool, void *additional)
+static void plain_global_init(void *pool, const char *server_name, void *additional)
 {
 	password_file = talloc_strdup(pool, (char*)additional);
 	if (password_file == NULL) {

src/auth/radius.c

@@ -38,8 +38,9 @@
 #define RAD_IPV4_DNS2 ((311<<16)|(29))
 
 static rc_handle *rh = NULL;
+static char nas_identifier[64];
 
-static void radius_global_init(void *pool, void *additional)
+static void radius_global_init(void *pool, const char *server_name, void *additional)
 {
 	rh = rc_read_config(additional);
 	if (rh == NULL) {
@@ -47,6 +48,11 @@ static void radius_global_init(void *pool, void *additional)
 		exit(1);
 	}
 
+	if (server_name)
+		strlcpy(nas_identifier, server_name, sizeof(nas_identifier));
+	else
+		nas_identifier[0] = 0;
+
 	if (rc_read_dictionary(rh, rc_conf_str(rh, "dictionary")) != 0) {
 		fprintf(stderr, "error reading the radius dictionary\n");
 		exit(1);
@@ -182,6 +188,16 @@ static int radius_auth_pass(void *ctx, const char *pass, unsigned pass_len)
 		goto cleanup;
 	}
 
+	if (nas_identifier[0] != 0) {
+		if (rc_avpair_add(rh, &send, PW_NAS_IDENTIFIER, nas_identifier, -1, 0) == NULL) {
+			syslog(LOG_ERR,
+			       "%s:%u: user '%s' auth error", __func__, __LINE__,
+			       pctx->username);
+			ret = ERR_AUTH_FAIL;
+			goto cleanup;
+		}
+	}
+
 	if (rc_avpair_add(rh, &send, PW_CALLING_STATION_ID, pctx->remote_ip, -1, 0) == NULL) {
 		syslog(LOG_ERR,
 		       "%s:%u: user '%s' auth error", __func__, __LINE__,
@@ -347,6 +363,12 @@ static void append_acct_standard(struct radius_ctx_st * pctx, rc_handle *rh,
 {
 	int i;
 
+	if (nas_identifier[0] != 0) {
+		if (rc_avpair_add(rh, send, PW_NAS_IDENTIFIER, nas_identifier, -1, 0) == NULL) {
+			return;
+		}
+	}
+
 	if (rc_avpair_add(rh, send, PW_USER_NAME, pctx->username, -1, 0) == NULL) {
 		return;
 	}

src/config.c

@@ -69,6 +69,7 @@ static struct cfg_options available_options[] = {
 	{ .name = "select-group", .type = OPTION_MULTI_LINE, .mandatory = 0 },
 	{ .name = "custom-header", .type = OPTION_MULTI_LINE, .mandatory = 0 },
 	{ .name = "split-dns", .type = OPTION_MULTI_LINE, .mandatory = 0 },
+	{ .name = "server-name", .type = OPTION_STRING, .mandatory = 0 },
 	{ .name = "listen-host", .type = OPTION_STRING, .mandatory = 0 },
 	{ .name = "listen-host-is-dyndns", .type = OPTION_BOOLEAN, .mandatory = 0 },
 	{ .name = "compression", .type = OPTION_BOOLEAN, .mandatory = 0 },
@@ -687,7 +688,7 @@ unsigned urlfw_size = 0;
 	/* When adding allocated data, remember to modify
 	 * reload_cfg_file();
 	 */
-	READ_STRING("listen-host", config->name);
+	READ_STRING("listen-host", config->listen_host);
 	READ_TF("listen-host-is-dyndns", config->is_dyndns, 0);
 	READ_STRING("listen-clear-file", config->unix_conn_file);
 
@@ -722,6 +723,7 @@ unsigned urlfw_size = 0;
 	READ_STRING("user-profile", config->xml_config_file);
 #endif
 
+	READ_STRING("server-name", config->server_name);
 	READ_STRING("ca-cert", config->ca);
 	READ_STRING("default-domain", config->default_domain);
 	READ_STRING("crl", config->crl);
@@ -1098,7 +1100,8 @@ unsigned i;
 	DEL(config->ocsp_response);
 	DEL(config->banner);
 	DEL(config->dh_params_file);
-	DEL(config->name);
+	DEL(config->listen_host);
+	DEL(config->server_name);
 	DEL(config->pin_file);
 	DEL(config->srk_pin_file);
 	DEL(config->ca);

src/main.c

@@ -374,7 +374,7 @@ listen_ports(void *pool, struct cfg_st* config,
 #endif
 		    ;
 
-		ret = getaddrinfo(config->name, portname, &hints, &res);
+		ret = getaddrinfo(config->listen_host, portname, &hints, &res);
 		if (ret != 0) {
 			fprintf(stderr, "getaddrinfo() failed: %s\n",
 				gai_strerror(ret));
@@ -410,7 +410,7 @@ listen_ports(void *pool, struct cfg_st* config,
 #endif
 		    ;
 
-		ret = getaddrinfo(config->name, portname, &hints, &res);
+		ret = getaddrinfo(config->listen_host, portname, &hints, &res);
 		if (ret != 0) {
 			fprintf(stderr, "getaddrinfo() failed: %s\n",
 				gai_strerror(ret));

src/ocserv-args.def

@@ -136,6 +136,9 @@ max-clients = 16
 # multiple times). Unset or set to zero for unlimited.
 max-same-clients = 2
 
+# Used to identify this particular server.
+server-name = ocserv@example.com
+
 # Use listen-host to limit to specific IPs or to the IPs of a provided 
 # hostname.
 #listen-host = [IP|HOSTNAME]

src/sec-mod-auth.c

@@ -62,7 +62,7 @@ void sec_auth_init(sec_mod_st * sec, struct cfg_st *config)
 
 	for (i=0;i<config->auth_methods;i++) {
 		if (config->auth[i].enabled && config->auth[i].amod && config->auth[i].amod->global_init)
-			config->auth[i].amod->global_init(sec, config->auth[i].additional);
+			config->auth[i].amod->global_init(sec, config->server_name, config->auth[i].additional);
 	}
 }
 

src/sec-mod-auth.h

@@ -30,7 +30,7 @@
 struct auth_mod_st {
 	unsigned int type;
 	unsigned int allows_retries; /* whether the module allows retries of the same password */
-	void (*global_init)(void *pool, void* additional);
+	void (*global_init)(void *pool, const char *server_name, void* additional);
 	void (*global_deinit)(void);
 	int (*auth_init)(void** ctx, void *pool, const char* username, const char* ip);
 	int (*auth_msg)(void* ctx, void *pool, char** msg);

src/vpn.h

@@ -235,7 +235,8 @@ typedef struct kkdcp_st {
 } kkdcp_st;
 
 struct cfg_st {
-	char *name; /* server name */
+	char *server_name;
+	char *listen_host;
 	unsigned int port;
 	unsigned int udp_port;
 	unsigned int is_dyndns;