diff --git a/reference/radius/constants.xml b/reference/radius/constants.xml index d02917e341..aaa0979dd4 100644 --- a/reference/radius/constants.xml +++ b/reference/radius/constants.xml @@ -3,137 +3,326 @@ &reftitle.constants; &extension.constants; - +
+ RADIUS Packet Types + + + RADIUS packets, whether requests or responses, always include a type. These + constants are provided to make it easier to specify types when using + radius_create_request and when comparing the result of + radius_send_request. + + RADIUS_ACCESS_REQUEST - () + (integer) - - Authentication Request - + + An Access-Request, used to authenticate a user against a RADIUS server. + Access request packets must include a + RADIUS_NAS_IP_ADDRESS + or a + RADIUS_NAS_IDENTIFIER + attribute, must also include a + RADIUS_USER_PASSWORD, + RADIUS_CHAP_PASSWORD + or a + RADIUS_STATE + attribute, and should include a + RADIUS_USER_NAME + attribute. + RADIUS_ACCESS_ACCEPT - () + (integer) - - Access accepted - + + An Access-Accept response to an Access-Request indicating that the + RADIUS server authenticated the user successfully. + RADIUS_ACCESS_REJECT - () + (integer) - - Access rejected - - - - - - RADIUS_ACCOUNTING_REQUEST - () - - - - Accounting request - - - - - - RADIUS_ACCOUNTING_RESPONSE - () - - - - Accounting response - + + An Access-Reject response to an Access-Request indicating that the + RADIUS server could not authenticate the user. + RADIUS_ACCESS_CHALLENGE - () + (integer) - - Accsess challenge - + + An Access-Challenge response to an Access-Request indicating that the + RADIUS server requires further information in another Access-Request + before authenticating the user. + + + + RADIUS_ACCOUNTING_REQUEST + (integer) + + + + An Accounting-Request, used to convey accounting information for a + service to the RADIUS server. + + + + + + RADIUS_ACCOUNTING_RESPONSE + (integer) + + + + An Accounting-Response response to an Accounting-Request. + + + + + + RADIUS_COA_REQUEST + (integer) + + + + A CoA-Request, sent from the RADIUS server to indicate that the + authorisations within the user session have changed. A response must be + sent in the form of a CoA-ACK or a CoA-NAK. + + + This constant is available in PECL radius 1.3.0 and later. + + + + + + RADIUS_COA_ACK + (integer) + + + + A CoA-ACK, sent to the RADIUS server to indicate that the user + authorisations have been updated. + + + This constant is available in PECL radius 1.3.0 and later. + + + + + + RADIUS_COA_NAK + (integer) + + + + A CoA-NAK, sent to the RADIUS server to indicate that the user + authorisations could not be updated. + + + This constant is available in PECL radius 1.3.0 and later. + + + + + + RADIUS_DISCONNECT_REQUEST + (integer) + + + + A Disconnect-Request, sent from the RADIUS server to indicate that the + user session must be terminated. + + + This constant is available in PECL radius 1.3.0 and later. + + + + + + RADIUS_DISCONNECT_ACK + (integer) + + + + A Disconnect-ACK, sent to the RADIUS server to indicate that the user + session has been terminated. + + + This constant is available in PECL radius 1.3.0 and later. + + + + + + RADIUS_DISCONNECT_NAK + (integer) + + + + A Disconnect-NAK, sent to the RADIUS server to indicate that the user + session could not be terminated. + + + This constant is available in PECL radius 1.3.0 and later. + + + + +
+ +
+ RADIUS Attribute Types + + + These constants define RADIUS attribute types that can be used with + radius_put_addr, radius_put_attr, + radius_put_int and + radius_put_string. + + + RADIUS_USER_NAME - (string) + (integer) - - Username - + + The User-Name attribute. The attribute value is expected to be a + string containing the name of the user being authenticated, + and can be set using radius_put_attr. + RADIUS_USER_PASSWORD - (string) + (integer) - - Password - + + The User-Password attribute. The attribute value is expected to be a + string containing the user's password, and can be set using + radius_put_attr. This value will be obfuscated on + transmission as described in + section 5.2 of RFC 2865. + RADIUS_CHAP_PASSWORD - (string) + (integer) - - Chap Password: chappass = md5(ident + plaintextpass + challenge) - + + The Chap-Password attribute. The attribute value is expected to be a + string with the first byte containing the CHAP identifier, + and the subsequent 16 bytes containing the MD5 hash of the CHAP + identifier, the plaintext password and the CHAP challenge value + concatenated together. Note that the CHAP challenge value should also be + sent separately in a + RADIUS_CHAP_CHALLENGE + attribute. + + + + Using CHAP passwords + + +]]> + + + RADIUS_NAS_IP_ADDRESS - (string) + (integer) - - NAS IP-Adress - + + The NAS-IP-Address attribute. The attribute value is expected to the IP + address of the RADIUS client encoded as an integer, which + can be set using radius_put_addr. + RADIUS_NAS_PORT - (int) + (integer) - - NAS Port - + + The NAS-Port attribute. The attribute value is expected to be the + physical port of the user on the RADIUS client encoded as an + integer, which can be set using + radius_put_int. + RADIUS_SERVICE_TYPE - (int) + (integer) - Type of Service, one of: + The Service-Type attribute. The attribute value indicates the service + type the user is requesting, and is expected to be an + integer, which can be set using + radius_put_int. + + + A number of constants are provided to represent the possible values of + this attribute. They include: RADIUS_LOGIN RADIUS_FRAMED @@ -151,11 +340,14 @@ RADIUS_FRAMED_PROTOCOL - (int) + (integer) - Framed Protocol, one of: + The Framed-Protocol attribute. The attribute value is expected to be an + integer indicating the framing to be used for framed + access, and can be set using radius_put_int. The + possible attribute values include these constants: RADIUS_PPP RADIUS_SLIP @@ -169,70 +361,98 @@ RADIUS_FRAMED_IP_ADDRESS - (int) + (integer) - - IPv4 Internet network address - + + The Framed-IP-Address attribute. The attribute value is expected to be + the address of the user's network encoded as an integer, + which can be set using radius_put_addr and + retrieved using radius_cvt_addr. + RADIUS_FRAMED_IP_NETMASK - (string) + (integer) - - Netmask - + + The Framed-IP-Netmask attribute. The attribute value is expected to be + the netmask of the user's network encoded as an integer, + which can be set using radius_put_addr and + retrieved using radius_cvt_addr. + RADIUS_FRAMED_ROUTING - (int) + (integer) - - Routing - + + The Framed-Routing attribute. The attribute value is expected to be an + integer indicating the routing method for the user, which + can be set using radius_put_int. + + + Possible values include: + + 0: No routing + 1: Send routing packets + 2: Listen for routing packets + 3: Send and listen + + RADIUS_FILTER_ID - (string) + (integer) - - Filter ID - + + The Filter-ID attribute. The attribute value is expected to be an + implementation-specific, human-readable string of filters, + which can be set using radius_put_attr. + RADIUS_FRAMED_MTU - (int) + (integer) - - MTU - + + The Framed-MTU attribute. The attribute value is expected to be an + integer indicating the MTU to be configured for the user, + and can be set using radius_put_int. + RADIUS_FRAMED_COMPRESSION - (int) + (integer) - Compression, one of: + The Framed-Compression attribute. The attribute value is expected to be + an integer indicating the compression protocol to be used, + and can be set using radius_put_int. Possible + values include these constants: - RADIUS_COMP_NONE - RADIUS_COMP_VJ - RADIUS_COMP_IPXHDR + RADIUS_COMP_NONE: No compression + RADIUS_COMP_VJ: VJ TCP/IP header compression + RADIUS_COMP_IPXHDR: IPX header compression + + RADIUS_COMP_STAC_LZS: + Stac-LZS compression (added in PECL radius 1.3.0b2) + @@ -240,282 +460,317 @@ RADIUS_LOGIN_IP_HOST - (string) + (integer) - - Login IP Host - + + The Login-IP-Host attribute. The attribute value is expected to the IP + address to connect the user to, encoded as an integer, + which can be set using radius_put_addr. + RADIUS_LOGIN_SERVICE - (int) + (integer) - - Login Service - + + The Login-Service attribute. The attribute value is an + integer indicating the service to connect the user to on + the login host. The value can be converted to a PHP integer via + radius_cvt_int. + RADIUS_LOGIN_TCP_PORT - (int) + (integer) - - Login TCP Port - + + The Login-TCP-Port attribute. The attribute value is an + integer indicating the port to connect the user to on the + login host. The value can be converted to a PHP integer via + radius_cvt_int. + RADIUS_REPLY_MESSAGE - (string) + (integer) - - Reply Message - + + The Reply-Message attribute. The attribute value is a + string containing text that may be displayed to the user in + response to an access request. + RADIUS_CALLBACK_NUMBER - (string) + (integer) - - Callback Number - + + The Callback-Number attribute. The attribute value is a + string containing the dialing string to use for callback. + RADIUS_CALLBACK_ID - (string) + (integer) - - Callback ID - + + The Callback-Id attribute. The attribute value is a string + containing an implementation-specific name of the place to be called. + RADIUS_FRAMED_ROUTE - (string) + (integer) - - Framed Route - + + The Framed-Route attribute. The attribute value is a string + containing an implementation-specific set of routes to be configured for + the user. + RADIUS_FRAMED_IPX_NETWORK - (string) + (integer) - - Framed IPX Network - + + The Framed-IPX-Network attribute. The attribute value is an + integer containing the IPX network to be configured for the + user, or 0xFFFFFFFE to indicate that the RADIUS + client should select the network, and can be accessed via + radius_cvt_int. + RADIUS_STATE - (string) + (integer) - - State - + + The State attribute. The attribute value is an implementation-defined + string included in an Access-Challenge from a server that + must be included in the subsequent Access-Request, and can be set using + radius_put_attr. + RADIUS_CLASS - (int) + (integer) - - Class - + + The Class attribute. The attribute value is an arbitrary + string included in an Access-Accept message that should + then be sent to the accounting server in Accounting-Request messages, + and can be set using radius_put_attr. + RADIUS_VENDOR_SPECIFIC - (int) + (integer) - - Vendor specific attribute - + + The Vendor-Specific attribute. In general, vendor attribute values + should be set using radius_put_vendor_addr, + radius_put_vendor_attr, + radius_put_vendor_int and + radius_put_vendor_string, rather than directly. + + + This constant is mostly useful when interpreting vendor specific + attributes in responses from a RADIUS server; when a vendor specific + attribute is received, the radius_get_vendor_attr + function should be used to access the vendor ID, attribute type and + attribute value. + RADIUS_SESSION_TIMEOUT - (int) + (integer) - + Session timeout - + RADIUS_IDLE_TIMEOUT - (int) + (integer) - + Idle timeout - + RADIUS_TERMINATION_ACTION - (int) + (integer) - + Termination action - + RADIUS_CALLED_STATION_ID - (int) + (integer) - + Called Station Id - + RADIUS_CALLING_STATION_ID - (string) + (integer) - + Calling Station Id - + RADIUS_NAS_IDENTIFIER - (int) + (integer) - + NAS ID - + RADIUS_PROXY_STATE - (int) + (integer) - + Proxy State - + RADIUS_LOGIN_LAT_SERVICE - (int) + (integer) - + Login LAT Service - + RADIUS_LOGIN_LAT_NODE - (int) + (integer) - + Login LAT Node - + RADIUS_LOGIN_LAT_GROUP - (int) + (integer) - + Login LAT Group - + RADIUS_FRAMED_APPLETALK_LINK - (int) + (integer) - + Framed Appletalk Link - + RADIUS_FRAMED_APPLETALK_NETWORK - (int) + (integer) - + Framed Appletalk Network - + RADIUS_FRAMED_APPLETALK_ZONE - (int) + (integer) - + Framed Appletalk Zone - + RADIUS_CHAP_CHALLENGE - (string) + (integer) - + Challenge - + RADIUS_NAS_PORT_TYPE - (int) + (integer) @@ -548,40 +803,40 @@ RADIUS_PORT_LIMIT - (int) + (integer) - + Port Limit - + RADIUS_LOGIN_LAT_PORT - (int) + (integer) - + Login LAT Port - + RADIUS_CONNECT_INFO - (string) + (integer) - + Connect info - + RADIUS_ACCT_STATUS_TYPE - (int) + (integer) @@ -598,51 +853,51 @@ RADIUS_ACCT_DELAY_TIME - (int) + (integer) - + Accounting delay time - + RADIUS_ACCT_INPUT_OCTETS - (int) + (integer) - + Accounting input bytes - + RADIUS_ACCT_OUTPUT_OCTETS - (int) + (integer) - + Accounting output bytes - + RADIUS_ACCT_SESSION_ID - (int) + (integer) - + Accounting session ID - + RADIUS_ACCT_AUTHENTIC - (int) + (integer) @@ -658,40 +913,40 @@ RADIUS_ACCT_SESSION_TIME - (int) + (integer) - + Accounting session time - + RADIUS_ACCT_INPUT_PACKETS - (int) + (integer) - + Accounting input packets - + RADIUS_ACCT_OUTPUT_PACKETS - (int) + (integer) - + Accounting output packets - + RADIUS_ACCT_TERMINATE_CAUSE - (int) + (integer) @@ -722,72 +977,81 @@ RADIUS_ACCT_MULTI_SESSION_ID - (string) + (integer) - + Accounting multi session ID - + RADIUS_ACCT_LINK_COUNT - (int) - - - - Accounting link count - - - - - - RADIUS_VENDOR_MICROSOFT - (int) + (integer) - Microsoft specific vendor attributes (RFC 2548), one of: - - RADIUS_MICROSOFT_MS_CHAP_RESPONSE - RADIUS_MICROSOFT_MS_CHAP_ERROR - RADIUS_MICROSOFT_MS_CHAP_PW_1 - RADIUS_MICROSOFT_MS_CHAP_PW_2 - RADIUS_MICROSOFT_MS_CHAP_LM_ENC_PW - RADIUS_MICROSOFT_MS_CHAP_NT_ENC_PW - RADIUS_MICROSOFT_MS_MPPE_ENCRYPTION_POLICY - RADIUS_MICROSOFT_MS_MPPE_ENCRYPTION_TYPES - RADIUS_MICROSOFT_MS_RAS_VENDOR - RADIUS_MICROSOFT_MS_CHAP_DOMAIN - RADIUS_MICROSOFT_MS_CHAP_CHALLENGE - RADIUS_MICROSOFT_MS_CHAP_MPPE_KEYS - RADIUS_MICROSOFT_MS_BAP_USAGE - RADIUS_MICROSOFT_MS_LINK_UTILIZATION_THRESHOLD - RADIUS_MICROSOFT_MS_LINK_DROP_TIME_LIMIT - RADIUS_MICROSOFT_MS_MPPE_SEND_KEY - RADIUS_MICROSOFT_MS_MPPE_RECV_KEY - RADIUS_MICROSOFT_MS_RAS_VERSION - RADIUS_MICROSOFT_MS_OLD_ARAP_PASSWORD - RADIUS_MICROSOFT_MS_NEW_ARAP_PASSWORD - RADIUS_MICROSOFT_MS_ARAP_PASSWORD_CHANGE_REASON - RADIUS_MICROSOFT_MS_FILTER - RADIUS_MICROSOFT_MS_ACCT_AUTH_TYPE - RADIUS_MICROSOFT_MS_ACCT_EAP_TYPE - RADIUS_MICROSOFT_MS_CHAP2_RESPONSE - RADIUS_MICROSOFT_MS_CHAP2_SUCCESS - RADIUS_MICROSOFT_MS_CHAP2_PW - RADIUS_MICROSOFT_MS_PRIMARY_DNS_SERVER - RADIUS_MICROSOFT_MS_SECONDARY_DNS_SERVER - RADIUS_MICROSOFT_MS_PRIMARY_NBNS_SERVER - RADIUS_MICROSOFT_MS_SECONDARY_NBNS_SERVER - RADIUS_MICROSOFT_MS_ARAP_CHALLENGE - + Accounting link count - +
+ +
+ RADIUS Vendor Specific Attribute Types + + + + + + RADIUS_VENDOR_MICROSOFT + (integer) + + + + Microsoft specific vendor attributes (RFC 2548), one of: + + RADIUS_MICROSOFT_MS_CHAP_RESPONSE + RADIUS_MICROSOFT_MS_CHAP_ERROR + RADIUS_MICROSOFT_MS_CHAP_PW_1 + RADIUS_MICROSOFT_MS_CHAP_PW_2 + RADIUS_MICROSOFT_MS_CHAP_LM_ENC_PW + RADIUS_MICROSOFT_MS_CHAP_NT_ENC_PW + RADIUS_MICROSOFT_MS_MPPE_ENCRYPTION_POLICY + RADIUS_MICROSOFT_MS_MPPE_ENCRYPTION_TYPES + RADIUS_MICROSOFT_MS_RAS_VENDOR + RADIUS_MICROSOFT_MS_CHAP_DOMAIN + RADIUS_MICROSOFT_MS_CHAP_CHALLENGE + RADIUS_MICROSOFT_MS_CHAP_MPPE_KEYS + RADIUS_MICROSOFT_MS_BAP_USAGE + RADIUS_MICROSOFT_MS_LINK_UTILIZATION_THRESHOLD + RADIUS_MICROSOFT_MS_LINK_DROP_TIME_LIMIT + RADIUS_MICROSOFT_MS_MPPE_SEND_KEY + RADIUS_MICROSOFT_MS_MPPE_RECV_KEY + RADIUS_MICROSOFT_MS_RAS_VERSION + RADIUS_MICROSOFT_MS_OLD_ARAP_PASSWORD + RADIUS_MICROSOFT_MS_NEW_ARAP_PASSWORD + RADIUS_MICROSOFT_MS_ARAP_PASSWORD_CHANGE_REASON + RADIUS_MICROSOFT_MS_FILTER + RADIUS_MICROSOFT_MS_ACCT_AUTH_TYPE + RADIUS_MICROSOFT_MS_ACCT_EAP_TYPE + RADIUS_MICROSOFT_MS_CHAP2_RESPONSE + RADIUS_MICROSOFT_MS_CHAP2_SUCCESS + RADIUS_MICROSOFT_MS_CHAP2_PW + RADIUS_MICROSOFT_MS_PRIMARY_DNS_SERVER + RADIUS_MICROSOFT_MS_SECONDARY_DNS_SERVER + RADIUS_MICROSOFT_MS_PRIMARY_NBNS_SERVER + RADIUS_MICROSOFT_MS_SECONDARY_NBNS_SERVER + RADIUS_MICROSOFT_MS_ARAP_CHALLENGE + + + + + + +