types

package
v1.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 15, 2026 License: MIT Imports: 6 Imported by: 0

Documentation

Overview

Package types holds the protocol constants and shared primitive types for the tacacs library: protocol versions, packet types, header flags, the authentication/authorization/accounting enumerations, privilege levels, the Argument codec, the predefined AVP name constants and constructors, the disconnect-cause enumerations, packet size limits, and the Logger interface used by the core library.

Constant values follow RFC 8907 ("TACACS+ Protocol"). Each enumeration is a named type so that distinct value spaces cannot be mixed at compile time.

The predefined AVP name constants are organized by vendor. avp.go holds the pairs shared by all vendors: the RFC 8907 base set (§6 authorization and §8.3 accounting arguments, including err_msg, bytes and paks) plus the Cisco & Huawei common traditional pairs (acl, addr, addr-pool, autocmd, callback-line, dns-servers, gw-password, idletime, ip-addresses, nocallback-verify, nohangup, source-ip, tunnel-id), and the disconnect-cause dual naming (disc-cause vs disc_cause). Vendor-specific pairs live in avp_cisco.go (the full Cisco IOS TACACS+ AV pair reference, including the L2TP/VPDN, SAP, fax and accounting pairs), avp_huawei.go (HWTACACS rate/tunnel/ftp pairs), avp_juniper.go (Junos exec attributes) and avp_paloalto.go (PAN-OS administrator VSAs). Disconnect-cause codes are enumerated by DiscCause and DiscCauseExt.

Index

Constants

View Source 
const (
	ArgSeparatorMandatory byte = '=' // 0x3d
	ArgSeparatorOptional  byte = '*' // 0x2a
)

Argument separators (RFC 8907 §5.1). The separator immediately follows the argument name: '=' marks a mandatory argument, '*' marks an optional one.

View Source 
const (
	JuniperAuthTypeLocal  = "local"
	JuniperAuthTypeRemote = "remote"
)

Values of the authentication-type AV pair: the method used to authenticate the user, as reported back by the device.

View Source 
const (
	// HeaderLength is the fixed TACACS+ header size in bytes.
	HeaderLength = 12
	// MaxPacketSize is the recommended maximum packet size (RFC 8907 §4.1).
	MaxPacketSize = 1 << 16 // 65536
	// MaxArgCount is the maximum number of arguments, since arg_cnt is a
	// single byte.
	MaxArgCount = 255
	// MaxArgLength is the maximum length in bytes of a single argument-value
	// pair (RFC 8907 §5.1).
	MaxArgLength = 255
	// MinArgLength is the minimum length in bytes of an argument-value pair:
	// one name character plus the separator (RFC 8907 §5.1).
	MinArgLength = 2
)

Packet and field size limits (RFC 8907 §4 and §5.1).

View Source 
const (
	// MinorVersionNone is the default minor version, used for ASCII
	// authentication, authorization and accounting.
	MinorVersionNone byte = 0x00
	// MinorVersionOne is used for PAP, CHAP, MS-CHAP and MS-CHAPv2
	// authentication (RFC 8907 §5.4.1).
	MinorVersionOne byte = 0x01
)

Minor version values (RFC 8907 §4.4).

View Source 
const ContinueFlagAbort byte = 0x01

ContinueFlagAbort is the authentication CONTINUE flag indicating that the session is being aborted by the client (CONTINUE byte 4, RFC 8907 §5.3.2).

View Source 
const JunosExecService = "junos-exec"

JunosExecService is the value of the service AVP that selects the Junos exec authorization profile (analogous to Cisco's "shell"). Juniper attributes such as local-user-name and allow-commands are carried inside this profile.

View Source 
const MajorVersion byte = 0x0c

MajorVersion is the major protocol version (RFC 8907 §4.4). It is always 0xc for TACACS+.

View Source 
const PaloAltoProtocol = "firewall"

PaloAltoProtocol is the value of the protocol AVP that identifies the device type. PAN-OS requires the value "firewall".

View Source 
const PaloAltoService = "PaloAlto"

PaloAltoService is the value of the service AVP that identifies the authorization profile as specific to Palo Alto Networks. PAN-OS requires the value "PaloAlto".

View Source 
const ReplyFlagNoEcho byte = 0x01

ReplyFlagNoEcho is the authentication REPLY flag indicating that the data echoed back to the server (in a subsequent CONTINUE) should not be echoed locally (REPLY byte 1, RFC 8907 §5.4.1).

Variables

This section is empty.

Functions

func MinorVersionFor 

func MinorVersionFor(t AuthenType) byte

MinorVersionFor returns the minor version to use for an authentication exchange per RFC 8907 §5.4.1: ASCII uses 0; PAP, CHAP, MS-CHAP and MS-CHAPv2 use 1. Authorization and accounting always use 0.

Types

type AcctFlags 

type AcctFlags byte

AcctFlags is the accounting REQUEST flags byte. 

const (
	AcctFlagStart    AcctFlags = 0x02
	AcctFlagStop     AcctFlags = 0x04
	AcctFlagWatchdog AcctFlags = 0x08
)

Accounting REQUEST flags (RFC 8907 §7.2 / Table 2). 

const AcctFlagMask AcctFlags = 0x0e

AcctFlagMask is the mask used to classify the accounting record type (RFC 8907 Table 2 column "flags & 0xE").

func (AcctFlags) Record 

func (f AcctFlags) Record() AcctRecord

Record returns the accounting record classification for the given flags. The caller MUST reject AcctRecordInvalid (RFC 8907 Table 2).

type AcctRecord 

type AcctRecord byte

AcctRecord classifies an accounting request by its flags (RFC 8907 Table 2). 

const (
	AcctRecordInvalid            AcctRecord = 0x00
	AcctRecordStart              AcctRecord = 0x02
	AcctRecordStop               AcctRecord = 0x04
	AcctRecordWatchdogNoUpdate   AcctRecord = 0x08
	AcctRecordWatchdogWithUpdate AcctRecord = 0x0a
)

Accounting record classifications (RFC 8907 Table 2).

type AcctStatus 

type AcctStatus byte

AcctStatus is the accounting REPLY status. 

const (
	AcctStatusSuccess AcctStatus = 0x01
	AcctStatusError   AcctStatus = 0x02
	AcctStatusFollow  AcctStatus = 0x21
)

Accounting statuses (RFC 8907 §8.3). AcctStatusFollow is deprecated.

func (AcctStatus) String 

func (s AcctStatus) String() string

String returns a human-readable name for the accounting status.

type ArgName added in v1.2.0 

type ArgName string

ArgName is the name of a predefined TACACS+ argument-value pair. It is a named string so that predefined AVP names are distinct from ad-hoc strings at compile time, while remaining zero-cost to use in an Argument. The common names below are shared by all vendors (RFC 8907 plus the Cisco/Huawei traditional pairs); vendor-specific names live in avp_cisco.go, avp_huawei.go, avp_juniper.go and avp_paloalto.go. Where Cisco and Huawei disagree on the separator (hyphen vs underscore, e.g. disc-cause / disc_cause), both spellings are provided and the Huawei variant is suffixed "Underscore". 

const (
	// RFC 8907 §6 authorization AV pairs (shared by all vendors).
	ArgNameService  ArgName = "service"
	ArgNameCmd      ArgName = "cmd"
	ArgNameCmdArg   ArgName = "cmd-arg"
	ArgNamePrivLvl  ArgName = "priv-lvl" // authorization uses a hyphen
	ArgNameProtocol ArgName = "protocol"
	// Cisco & Huawei shared authorization AV pairs.
	ArgNameAcl              ArgName = "acl"
	ArgNameAddr             ArgName = "addr"
	ArgNameAddrPool         ArgName = "addr-pool"
	ArgNameAutocmd          ArgName = "autocmd"
	ArgNameCallbackLine     ArgName = "callback-line"
	ArgNameDnsServers       ArgName = "dns-servers"
	ArgNameIdletime         ArgName = "idletime"
	ArgNameIpAddresses      ArgName = "ip-addresses"
	ArgNameGwPassword       ArgName = "gw-password" // secret-bearing
	ArgNameNocallbackVerify ArgName = "nocallback-verify"
	ArgNameNohangup         ArgName = "nohangup"
	ArgNameSourceIP         ArgName = "source-ip"
	ArgNameTunnelID         ArgName = "tunnel-id" // Cisco & Huawei: VPDN tunnel username
)

Authentication and authorization AV pairs shared by all vendors: the RFC 8907 §6 base set (service, cmd, cmd-arg, priv-lvl, protocol) plus the Cisco & Huawei common traditional pairs. service MUST always be present in an authorization or accounting request (RFC 8907 §5.1). Cisco-only pairs (callback-dialstring, inacl, outacl, noescape, old-prompts, routing, route, ...) are in avp_cisco.go. 

const (
	ArgNameBytes       ArgName = "bytes" // total bytes transferred
	ArgNamePaks        ArgName = "paks"  // total packets transferred
	ArgNameBytesIn     ArgName = "bytes_in"
	ArgNameBytesOut    ArgName = "bytes_out"
	ArgNamePaksIn      ArgName = "paks_in"
	ArgNamePaksOut     ArgName = "paks_out"
	ArgNameElapsedTime ArgName = "elapsed_time"
	ArgNameTaskID      ArgName = "task_id"
	ArgNameTimezone    ArgName = "timezone"
	ArgNameStartTime   ArgName = "start_time"
	ArgNameStopTime    ArgName = "stop_time"
	ArgNameEvent       ArgName = "event"
	ArgNameReason      ArgName = "reason"
	ArgNameErrMsg      ArgName = "err_msg"
	ArgNamePort        ArgName = "port"
	ArgNamePrivLevel   ArgName = "priv_level" // accounting uses an underscore
)

Accounting AV pairs (RFC 8907 §8.3), shared by all vendors. Cisco-only accounting pairs (nas-rx-speed, nas-tx-speed, mlp-links-max, mlp-sess-id, pre-session-time, Fax-*, ...) are in avp_cisco.go. 

const (
	ArgNameDiscCause              ArgName = "disc-cause"
	ArgNameDiscCauseUnderscore    ArgName = "disc_cause"
	ArgNameDiscCauseExt           ArgName = "disc-cause-ext"
	ArgNameDiscCauseExtUnderscore ArgName = "disc_cause_ext"
)

Disconnect-cause AV pairs. Cisco uses the hyphenated spelling (disc-cause, disc-cause-ext); Huawei uses the underscore spelling (disc_cause, disc_cause_ext). Both are provided; callers pick the one that matches the peer they interoperate with. 

const (
	// Already implemented, moved from avp.go.
	ArgNameCallbackDialstring ArgName = "callback-dialstring" // service=shell/arap/slip/ppp
	ArgNameCallbackRotary     ArgName = "callback-rotary"     // rotary group 0-100
	ArgNameInacl              ArgName = "inacl"               // indexed: inacl#<n>, also inacl=x
	ArgNameOutacl             ArgName = "outacl"              // indexed: outacl#<n>, also outacl=x
	ArgNameNoescape           ArgName = "noescape"            // service=shell
	ArgNameOldPrompts         ArgName = "old-prompts"
	ArgNameRouting            ArgName = "routing"
	ArgNameRoute              ArgName = "route" // indexed: route#<n>

	// Completed from the Cisco doc (Authentication and Authorization table).
	ArgNameDataService           ArgName = "data-service"              // service=outbound, protocol=ip
	ArgNameDialNumber            ArgName = "dial-number"               // service=outbound, protocol=ip
	ArgNameForce56               ArgName = "force-56"                  // service=outbound, protocol=ip
	ArgNameInterfaceConfig       ArgName = "interface-config"          // indexed: interface-config#<n>, service=ppp
	ArgNameL2tpBusyDisconnect    ArgName = "l2tp-busy-disconnect"      // service=ppp, protocol=vpdn
	ArgNameL2tpCmLocalWindowSize ArgName = "l2tp-cm-local-window-size" // service=ppp, protocol=vpdn
	ArgNameL2tpDropOutOfOrder    ArgName = "l2tp-drop-out-of-order"    // service=ppp, protocol=vpdn
	ArgNameL2tpHelloInterval     ArgName = "l2tp-hello-interval"       // service=ppp, protocol=vpdn
	ArgNameL2tpHiddenAvp         ArgName = "l2tp-hidden-avp"           // service=ppp, protocol=vpdn
	ArgNameL2tpNosessionTimeout  ArgName = "l2tp-nosession-timeout"    // service=ppp, protocol=vpdn
	ArgNameL2tpTosReflect        ArgName = "l2tp-tos-reflect"          // service=ppp, protocol=vpdn
	ArgNameL2tpTunnelAuthen      ArgName = "l2tp-tunnel-authen"        // service=ppp, protocol=vpdn
	ArgNameL2tpTunnelPassword    ArgName = "l2tp-tunnel-password"      // key-bearing, service=ppp protocol=vpdn
	ArgNameL2tpUdpChecksum       ArgName = "l2tp-udp-checksum"         // service=ppp, protocol=vpdn
	ArgNameLinkCompression       ArgName = "link-compression"          // numeric 0-3, service=ppp
	ArgNameLoadThreshold         ArgName = "load-threshold"            // <n> 1-255, service=ppp protocol=multilink
	ArgNameMapClass              ArgName = "map-class"                 // service=outbound, protocol=ip
	ArgNameMaxLinks              ArgName = "max-links"                 // <n> 1-255, service=ppp protocol=multilink
	ArgNameMinLinks              ArgName = "min-links"                 // service=ppp protocol=multilink/vpdn
	ArgNameNasPassword           ArgName = "nas-password"              // key-bearing, service=ppp protocol=vpdn (L2F)
	ArgNamePoolDef               ArgName = "pool-def"                  // indexed: pool-def#<n>, service=ppp protocol=ip
	ArgNamePoolTimeout           ArgName = "pool-timeout"              // service=ppp protocol=ip
	ArgNamePortType              ArgName = "port-type"                 // physical port type
	ArgNamePppVjSlotCompression  ArgName = "ppp-vj-slot-compression"   // service=ppp
	ArgNameProxyacl              ArgName = "proxyacl"                  // indexed: proxyacl#<n>, downloadable ACL
	ArgNameRteFltrIn             ArgName = "rte-fltr-in"               // indexed: rte-fltr-in#<n>, routing-update input filter
	ArgNameRteFltrOut            ArgName = "rte-fltr-out"              // indexed: rte-fltr-out#<n>, routing-update output filter
	ArgNameSap                   ArgName = "sap"                       // indexed: sap#<n>, static SAP entries
	ArgNameSapFltrIn             ArgName = "sap-fltr-in"               // indexed: sap-fltr-in#<n>, input SAP filter
	ArgNameSapFltrOut            ArgName = "sap-fltr-out"              // indexed: sap-fltr-out#<n>, output SAP filter
	ArgNameSendAuth              ArgName = "send-auth"                 // PAP or CHAP after callback
	ArgNameSendSecret            ArgName = "send-secret"               // key-bearing, CHAP/PAP response secret
	ArgNameSpi                   ArgName = "spi"                       // mobile-IP auth info
	ArgNameTimeout               ArgName = "timeout"                   // minutes, EXEC/ARA disconnect
	ArgNameWinsServers           ArgName = "wins-servers"              // service=ppp protocol=ip
	ArgNameZonelist              ArgName = "zonelist"                  // numeric, service=arap (AppleTalk)
)

Authentication and authorization AV pairs specific to Cisco. Already implemented (shared with prior releases) plus the remaining pairs from the Cisco doc, ordered as in the reference table. 

const (
	// Already implemented, moved from avp.go.
	ArgNameNasRxSpeed     ArgName = "nas-rx-speed"
	ArgNameNasTxSpeed     ArgName = "nas-tx-speed"
	ArgNameMlpLinksMax    ArgName = "mlp-links-max"
	ArgNameMlpSessID      ArgName = "mlp-sess-id"
	ArgNamePreSessionTime ArgName = "pre-session-time"

	// Completed from the Cisco doc (Accounting AV Pairs table).
	ArgNameAbortCause          ArgName = "Abort-Cause"
	ArgNameCallType            ArgName = "Call-Type"
	ArgNameEmailServerAddress  ArgName = "Email-Server-Address"
	ArgNameEmailServerAckFlag  ArgName = "Email-Server-Ack-Flag"
	ArgNameFaxAccountIdOrigin  ArgName = "Fax-Account-Id-Origin"
	ArgNameFaxAuthStatus       ArgName = "Fax-Auth-Status"
	ArgNameFaxConnectSpeed     ArgName = "Fax-Connect-Speed"
	ArgNameFaxCoverpageFlag    ArgName = "Fax-Coverpage-Flag"
	ArgNameFaxDsnAddress       ArgName = "Fax-Dsn-Address"
	ArgNameFaxDsnFlag          ArgName = "Fax-Dsn-Flag"
	ArgNameFaxMdnAddress       ArgName = "Fax-Mdn-Address"
	ArgNameFaxMdnFlag          ArgName = "Fax-Mdn-Flag"
	ArgNameFaxModemTime        ArgName = "Fax-Modem-Time"
	ArgNameFaxMsgId            ArgName = "Fax-Msg-Id"
	ArgNameFaxPages            ArgName = "Fax-Pages"
	ArgNameFaxProcessAbortFlag ArgName = "Fax-Process-Abort-Flag"
	ArgNameFaxRecipientCount   ArgName = "Fax-Recipient-Count"
	ArgNameGatewayId           ArgName = "Gateway-Id"
	ArgNamePortUsed            ArgName = "Port-Used"
	ArgNamePreBytesIn          ArgName = "pre-bytes-in"
	ArgNamePreBytesOut         ArgName = "pre-bytes-out"
	ArgNamePrePaksIn           ArgName = "pre-paks-in"
	ArgNamePrePaksOut          ArgName = "pre-paks-out"
)

Accounting AV pairs specific to Cisco. Already implemented plus the remaining pairs from the Cisco Accounting AV Pairs table. The Fax-*, Email-*, Abort-Cause, Call-Type, Gateway-Id and Port-Used pairs belong to the Cisco IOS Store-and-Forward Fax feature (legacy); they are retained for completeness. 

const (
	ArgNameDataRate ArgName = ArgNameNasRxSpeed // deprecated alias for nas-rx-speed
	ArgNameXmitRate ArgName = ArgNameNasTxSpeed // deprecated alias for nas-tx-speed
)

Deprecated aliases. The Cisco doc notes data-rate was renamed to nas-rx-speed and xmit-rate to nas-tx-speed. These constants alias to the current names so legacy code emits the modern wire string rather than the obsolete one. 

const (
	// ArgNameShellRoles lists the user roles assigned to the user. The value
	// is a white-space-delimited list of group names, e.g.
	// "network-operator network-admin". Shell protocol only (access-accept).
	// When the optional separator '*' is used, NX-OS flags the VSA as optional
	// and other Cisco devices ignore it.
	ArgNameShellRoles ArgName = "shell:roles"
	// ArgNameShellPrivLvl is the privilege level under the shell protocol
	// namespace (the shell-namespaced counterpart of priv-lvl), used together
	// with SNMPv3 attributes. Shell protocol only.
	ArgNameShellPrivLvl ArgName = "shell:priv-lvl"
	// ArgNameAccountingInfo stores accounting information beyond the standard
	// TACACS+/RADIUS accounting attributes. Accounting protocol only
	// (accounting-request); it does not carry the "shell:" prefix.
	ArgNameAccountingInfo ArgName = "accountinginfo"
)

cisco-av-pair VSAs as used by Cisco NX-OS (and the same format on other Cisco platforms that honor the shell VSA). The NX-OS VSA format is "protocol:attribute separator value", where separator is '=' (mandatory) or '*' (optional). The shell protocol carries user-profile attributes in the authorization REPLY; the accounting protocol carries accountinginfo in accounting-request packets.

Source: Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 10.6(x), "VSA Format" and "Specifying Cisco NX-OS User Roles and SNMPv3 Parameters on AAA Servers".

Security: shell:roles and shell:priv-lvl are authorization-decision attributes (roles such as network-admin grant high privilege); they are validated server-side and must not be accepted from untrusted input. 

const (
	ArgNameDnAverage  ArgName = "dnaverage"
	ArgNameDnPeak     ArgName = "dnpeak"
	ArgNameUpAverage  ArgName = "upaverage"
	ArgNameUpPeak     ArgName = "uppeak"
	ArgNameTunnelType ArgName = "tunnel-type"
	ArgNameFtpDir     ArgName = "ftpdir"
)

Huawei-specific AV pair names. dnaverage/dnpeak/upaverage/uppeak report link rates in bit/s; tunnel-type describes the VPDN tunnel type; ftpdir sets the FTP user's initial directory. 

const (
	ArgNameLocalUserName             ArgName = "local-user-name"
	ArgNameAllowCommands             ArgName = "allow-commands"
	ArgNameAllowCommandsRegexps      ArgName = "allow-commands-regexps"
	ArgNameAllowConfiguration        ArgName = "allow-configuration"
	ArgNameAllowConfigurationRegexps ArgName = "allow-configuration-regexps"
	ArgNameDenyCommands              ArgName = "deny-commands"
	ArgNameDenyCommandsRegexps       ArgName = "deny-commands-regexps"
	ArgNameDenyConfiguration         ArgName = "deny-configuration"
	ArgNameDenyConfigurationRegexps  ArgName = "deny-configuration-regexps"
	ArgNameUserPermissions           ArgName = "user-permissions"
	ArgNameAuthenticationType        ArgName = "authentication-type"
	ArgNameSessionPort               ArgName = "session-port"
	ArgNameRefreshTimeInterval       ArgName = "refresh-time-interval"
)

Juniper-specific AV pair names (Junos Table 1 + refresh-time-interval). 

const (
	// ArgNamePaloAltoAdminRole is a default (dynamic) administrative role
	// name or a custom administrative role name on the firewall.
	ArgNamePaloAltoAdminRole ArgName = "PaloAlto-Admin-Role"
	// ArgNamePaloAltoAdminAccessDomain is the name of an access domain for
	// firewall administrators (Device > Access Domains). Define it when the
	// firewall has multiple virtual systems.
	ArgNamePaloAltoAdminAccessDomain ArgName = "PaloAlto-Admin-Access-Domain"
	// ArgNamePaloAltoPanoramaAdminRole is a default (dynamic) administrative
	// role name or a custom administrative role name on Panorama.
	ArgNamePaloAltoPanoramaAdminRole ArgName = "PaloAlto-Panorama-Admin-Role"
	// ArgNamePaloAltoPanoramaAdminAccessDomain is the name of an access
	// domain for Device Group and Template administrators on Panorama
	// (Panorama > Access Domains).
	ArgNamePaloAltoPanoramaAdminAccessDomain ArgName = "PaloAlto-Panorama-Admin-Access-Domain"
	// ArgNamePaloAltoUserGroup is the name of a user group in the Allow
	// List of an authentication profile.
	ArgNamePaloAltoUserGroup ArgName = "PaloAlto-User-Group"
)

Palo Alto-specific AV pair names (PAN-OS TACACS+ VSA table).

type Argument 

type Argument struct {
	// Mandatory is true when the separator is '='. The receiver MUST be able to
	// handle a mandatory argument, otherwise authorization fails (RFC 8907
	// §5.1).
	Mandatory bool
	// Name is the argument name. It MUST NOT contain a separator.
	Name string
	// Value is the argument value. It MAY contain separators and MAY be empty.
	Value string
}

Argument is a single authorization or accounting argument-value pair.

func AllowCommandsNumberedArg added in v1.3.0 

func AllowCommandsNumberedArg(n int, value string, mandatory bool) (Argument, error)

AllowCommandsNumberedArg builds the numbered allow-commands<n>=<regex> AV pair, granting command execution beyond the login class permission bits.

func AllowConfigurationNumberedArg added in v1.3.0 

func AllowConfigurationNumberedArg(n int, value string, mandatory bool) (Argument, error)

AllowConfigurationNumberedArg builds the numbered allow-configuration<n>=<regex> AV pair, granting view/modify access to configuration statements beyond the login class permission bits.

func CmdArg added in v1.2.0 

func CmdArg(value string) Argument

CmdArg builds a mandatory cmd=<value> AV pair, the shell command being authorized or accounted. The value is the command's first keyword during command authorization, or the full command line during accounting.

func CmdArgCR added in v1.2.0 

func CmdArgCR() Argument

CmdArgCR builds the mandatory cmd-arg=<cr> AV pair that terminates the cmd-arg list during command authorization.

func DenyCommandsNumberedArg added in v1.3.0 

func DenyCommandsNumberedArg(n int, value string, mandatory bool) (Argument, error)

DenyCommandsNumberedArg builds the numbered deny-commands<n>=<regex> AV pair, denying command execution otherwise allowed by the login class permission bits.

func DenyConfigurationNumberedArg added in v1.3.0 

func DenyConfigurationNumberedArg(n int, value string, mandatory bool) (Argument, error)

DenyConfigurationNumberedArg builds the numbered deny-configuration<n>=<regex> AV pair, denying view/modify access to configuration statements otherwise allowed by the login class permission bits.

func JunosExecServiceArg added in v1.3.0 

func JunosExecServiceArg() Argument

JunosExecServiceArg builds the mandatory service=junos-exec AV pair that opens the Junos exec authorization profile. Juniper-specific attributes are returned alongside it in the authorization REPLY.

func NewArg added in v1.2.0 

func NewArg(name ArgName, value string, mandatory bool) Argument

NewArg builds an Argument with the given name, value and mandatory flag. It is the generic constructor for predefined AV pairs.

func NewDiscCauseArg added in v1.2.0 

func NewDiscCauseArg(d DiscCause, mandatory bool) Argument

NewDiscCauseArg builds a disc-cause=<n> Argument using the Cisco hyphenated name. Use NewMandatoryArg(ArgNameDiscCauseUnderscore, ...) for the Huawei underscore spelling.

func NewDiscCauseExtArg added in v1.2.0 

func NewDiscCauseExtArg(d DiscCauseExt, mandatory bool) Argument

NewDiscCauseExtArg builds a disc-cause-ext=<n> Argument using the Cisco hyphenated name. Use NewMandatoryArg(ArgNameDiscCauseExtUnderscore, ...) for the Huawei underscore spelling.

func NewIndexedArg added in v1.2.0 

func NewIndexedArg(name ArgName, n int, value string, mandatory bool) (Argument, error)

NewIndexedArg builds an Argument whose name carries a numeric index suffix of the form "name#<n>", used by AV pairs such as inacl#1, outacl#2 and route#3. It returns ErrInvalidArgument if n is not positive or if name already contains a '#', which would make the index ambiguous.

func NewJuniperNumberedArg added in v1.3.0 

func NewJuniperNumberedArg(name ArgName, n int, value string, mandatory bool) (Argument, error)

NewJuniperNumberedArg builds an Argument whose name carries a numeric suffix of the form "name<n>" (e.g. allow-commands1, deny-commands3), the Juniper numbered form used to repeat an attribute with distinct values. It returns ErrInvalidArgument if n is not positive or if name already ends in a digit, which would make the suffix ambiguous (e.g. "foo2" + 3 -> "foo23").

func NewMandatoryArg added in v1.2.0 

func NewMandatoryArg(name ArgName, value string) Argument

NewMandatoryArg builds a mandatory Argument ("name=value").

func NewOptionalArg added in v1.2.0 

func NewOptionalArg(name ArgName, value string) Argument

NewOptionalArg builds an optional Argument ("name*value").

func PaloAltoAdminAccessDomainArg added in v1.4.0 

func PaloAltoAdminAccessDomainArg(domain string, mandatory bool) Argument

PaloAltoAdminAccessDomainArg builds the PaloAlto-Admin-Access-Domain=<domain> AV pair, assigning an access domain to a firewall administrator. Define it when the firewall has multiple virtual systems.

func PaloAltoAdminRoleArg added in v1.4.0 

func PaloAltoAdminRoleArg(role string, mandatory bool) Argument

PaloAltoAdminRoleArg builds the PaloAlto-Admin-Role=<role> AV pair, assigning a default (dynamic) or custom administrative role on the firewall.

func PaloAltoPanoramaAdminAccessDomainArg added in v1.4.0 

func PaloAltoPanoramaAdminAccessDomainArg(domain string, mandatory bool) Argument

PaloAltoPanoramaAdminAccessDomainArg builds the PaloAlto-Panorama-Admin-Access-Domain=<domain> AV pair, assigning an access domain to a Device Group or Template administrator on Panorama.

func PaloAltoPanoramaAdminRoleArg added in v1.4.0 

func PaloAltoPanoramaAdminRoleArg(role string, mandatory bool) Argument

PaloAltoPanoramaAdminRoleArg builds the PaloAlto-Panorama-Admin-Role=<role> AV pair, assigning a default (dynamic) or custom administrative role on Panorama.

func PaloAltoProtocolArg added in v1.4.0 

func PaloAltoProtocolArg() Argument

PaloAltoProtocolArg builds the mandatory protocol=firewall AV pair that identifies the device type. PAN-OS requires this attribute to be present.

func PaloAltoServiceArg added in v1.4.0 

func PaloAltoServiceArg() Argument

PaloAltoServiceArg builds the mandatory service=PaloAlto AV pair that identifies the VSAs as specific to Palo Alto Networks. PAN-OS requires this attribute to be present in the authorization REPLY.

func PaloAltoUserGroupArg added in v1.4.0 

func PaloAltoUserGroupArg(group string, mandatory bool) Argument

PaloAltoUserGroupArg builds the PaloAlto-User-Group=<group> AV pair, naming a user group in the Allow List of an authentication profile.

func ParseArgument 

func ParseArgument(s string) (Argument, error)

ParseArgument parses a single argument-value pair. The separator is the first '=' or '*' byte; the name is the text before it and the value is the text after it (RFC 8907 §5.1). A pair without a separator, or with an empty name, is invalid.

func PrivLvlArg added in v1.2.0 

func PrivLvlArg(lvl PrivLevel) Argument

PrivLvlArg builds a mandatory priv-lvl=<n> AV pair from a PrivLevel. The numeric form is used because PrivLevel has no String method of its own.

func ServiceArg added in v1.2.0 

func ServiceArg(value string) Argument

ServiceArg builds a mandatory service=<value> AV pair. "service" MUST always be present in an authorization or accounting request (RFC 8907 §5.1).

func SessionPortArg added in v1.3.0 

func SessionPortArg(port int, mandatory bool) Argument

SessionPortArg builds the session-port=<n> AV pair from a port number. session-port carries the source port of the established session (an integer value).

func ShellPrivLvlArg added in v1.4.0 

func ShellPrivLvlArg(lvl PrivLevel, mandatory bool) Argument

ShellPrivLvlArg builds the shell:priv-lvl=<n> AV pair from a PrivLevel, the shell-namespaced counterpart of priv-lvl used by NX-OS together with SNMPv3 attributes.

func ShellRolesArg added in v1.4.0 

func ShellRolesArg(roles []string, mandatory bool) Argument

ShellRolesArg builds the shell:roles=<roles> AV pair from a list of role names. The roles are joined by a single space, matching the NX-OS value format ("network-operator network-admin"). Set mandatory to false to emit the optional "shell:roles*<roles>" form (NX-OS then treats the pair as optional and other Cisco devices ignore it).

func UserPermissionsNumberedArg added in v1.3.0 

func UserPermissionsNumberedArg(n int, value string, mandatory bool) (Argument, error)

UserPermissionsNumberedArg builds the numbered user-permissions<n>=<flags> AV pair, granting a permission flag set in addition to the login class permissions.

func (Argument) String 

func (a Argument) String() string

String encodes the argument as "name=value" (mandatory) or "name*value" (optional).

type AuthenAction 

type AuthenAction byte

AuthenAction is the authentication action (START byte 0). 

const (
	AuthenLogin    AuthenAction = 0x01
	AuthenChpass   AuthenAction = 0x02
	AuthenSendauth AuthenAction = 0x04
)

Authentication actions (RFC 8907 §5.2.1).

type AuthenMethod 

type AuthenMethod byte

AuthenMethod is the authentication method reported in authorization and accounting requests (RFC 8907 §6.1). It MUST NOT be used in policy evaluation because it cannot be verified. 

const (
	AuthenMethodNotSet     AuthenMethod = 0x00
	AuthenMethodNone       AuthenMethod = 0x01
	AuthenMethodKrb5       AuthenMethod = 0x02
	AuthenMethodLine       AuthenMethod = 0x03
	AuthenMethodEnable     AuthenMethod = 0x04
	AuthenMethodLocal      AuthenMethod = 0x05
	AuthenMethodTacacsPlus AuthenMethod = 0x06
	AuthenMethodGuest      AuthenMethod = 0x08
	AuthenMethodRadius     AuthenMethod = 0x10
	AuthenMethodKrb4       AuthenMethod = 0x11
	AuthenMethodRcmd       AuthenMethod = 0x20
)

Authentication methods (RFC 8907 §6.1).

type AuthenService 

type AuthenService byte

AuthenService is the authentication service (START byte 3). 

const (
	AuthenServiceNone    AuthenService = 0x00
	AuthenServiceLogin   AuthenService = 0x01
	AuthenServiceEnable  AuthenService = 0x02
	AuthenServicePPP     AuthenService = 0x03
	AuthenServicePT      AuthenService = 0x05
	AuthenServiceRCMD    AuthenService = 0x06
	AuthenServiceX25     AuthenService = 0x07
	AuthenServiceNASI    AuthenService = 0x08
	AuthenServiceFWProxy AuthenService = 0x09
)

Authentication services (RFC 8907 §5.2.3).

type AuthenStatus 

type AuthenStatus byte

AuthenStatus is the authentication REPLY status (REPLY byte 0). 

const (
	AuthenStatusPass    AuthenStatus = 0x01
	AuthenStatusFail    AuthenStatus = 0x02
	AuthenStatusGetData AuthenStatus = 0x03
	AuthenStatusGetUser AuthenStatus = 0x04
	AuthenStatusGetPass AuthenStatus = 0x05
	AuthenStatusRestart AuthenStatus = 0x06
	AuthenStatusError   AuthenStatus = 0x07
	AuthenStatusFollow  AuthenStatus = 0x21
)

Authentication statuses (RFC 8907 §5.4.1). AuthenStatusFollow is deprecated and MUST be treated as Fail by clients.

func (AuthenStatus) String 

func (s AuthenStatus) String() string

String returns a human-readable name for the authentication status.

type AuthenType 

type AuthenType byte

AuthenType is the authentication type (START byte 2). 

const (
	AuthenTypeNotSet   AuthenType = 0x00
	AuthenTypeASCII    AuthenType = 0x01
	AuthenTypePAP      AuthenType = 0x02
	AuthenTypeCHAP     AuthenType = 0x03
	AuthenTypeMSCHAP   AuthenType = 0x05
	AuthenTypeMSCHAPv2 AuthenType = 0x06
)

Authentication types (RFC 8907 §5.2.2). AuthenTypeNotSet is only valid in authorization and accounting requests.

func (AuthenType) String added in v1.1.1 

func (t AuthenType) String() string

String returns a human-readable name for the authentication type, suitable as a metric label.

type AuthorStatus 

type AuthorStatus byte

AuthorStatus is the authorization REPLY status (REPLY byte 0). 

const (
	AuthorStatusPassAdd  AuthorStatus = 0x01
	AuthorStatusPassRepl AuthorStatus = 0x02
	AuthorStatusFail     AuthorStatus = 0x10
	AuthorStatusError    AuthorStatus = 0x11
	AuthorStatusFollow   AuthorStatus = 0x21
)

Authorization statuses (RFC 8907 §6.2). AuthorStatusFollow is deprecated and its arg_cnt MUST be 0.

func (AuthorStatus) String 

func (s AuthorStatus) String() string

String returns a human-readable name for the authorization status.

type DiscCause added in v1.2.0 

type DiscCause uint16

DiscCause is the value of the disc-cause accounting AV pair: the reason a connection was taken off-line (RFC 8907 §7, accounting-stop records). The numeric codes below are the common base shared by Cisco and Huawei implementations (see the Huawei HWTACACS attribute table). 

const (
	DiscCauseUserRequest    DiscCause = 1
	DiscCauseDataLost       DiscCause = 2
	DiscCauseServiceLost    DiscCause = 3
	DiscCauseIdleTimeout    DiscCause = 4
	DiscCauseSessionTimeout DiscCause = 5
	DiscCauseAdminRequest   DiscCause = 7
	DiscCauseNasError       DiscCause = 9
	DiscCauseNasRequest     DiscCause = 10
	DiscCausePortDisabled   DiscCause = 12
	DiscCauseUserError      DiscCause = 17
	DiscCauseHostRequest    DiscCause = 18
)

Disconnect causes.

func (DiscCause) String added in v1.2.0 

func (d DiscCause) String() string

String returns a hyphenated name for the disconnect cause, or "unknown(<n>)" for values outside the defined set.

type DiscCauseExt added in v1.2.0 

type DiscCauseExt uint16

DiscCauseExt is the value of the disc-cause-ext accounting AV pair, which extends disc-cause with vendor-specific reasons (Cisco Table 3, "Disconnect Cause Extensions"). Codes 1000-1068 mirror the Cisco table; the Huawei-only 1046 and 1100 are suffixed "HW". Note: Huawei assigns a different meaning to 1063 ("PPP handshake failure") than Cisco's "tcp-foreign-host-close"; the Cisco meaning is used here. 

const (
	DiscCauseExtNoReason           DiscCauseExt = 1000
	DiscCauseExtNoDisconnect       DiscCauseExt = 1001
	DiscCauseExtUnknown            DiscCauseExt = 1002
	DiscCauseExtCallDisconnect     DiscCauseExt = 1003
	DiscCauseExtCLIDAuthFail       DiscCauseExt = 1004
	DiscCauseExtNoModemAvailable   DiscCauseExt = 1009
	DiscCauseExtNoCarrier          DiscCauseExt = 1010
	DiscCauseExtLostCarrier        DiscCauseExt = 1011
	DiscCauseExtNoModemResults     DiscCauseExt = 1012
	DiscCauseExtTSUserExit         DiscCauseExt = 1020
	DiscCauseExtIdleTimeout        DiscCauseExt = 1021
	DiscCauseExtTSExitTelnet       DiscCauseExt = 1022
	DiscCauseExtTSNoIPAddr         DiscCauseExt = 1023
	DiscCauseExtTSTCPRawExit       DiscCauseExt = 1024
	DiscCauseExtTSBadPassword      DiscCauseExt = 1025
	DiscCauseExtTSNoTCPRaw         DiscCauseExt = 1026
	DiscCauseExtTSCNTLC            DiscCauseExt = 1027
	DiscCauseExtTSSessionEnd       DiscCauseExt = 1028
	DiscCauseExtTSCloseVconn       DiscCauseExt = 1029
	DiscCauseExtTSEndVconn         DiscCauseExt = 1030
	DiscCauseExtTSRloginExit       DiscCauseExt = 1031
	DiscCauseExtTSRloginOptInvalid DiscCauseExt = 1032
	DiscCauseExtTSInsuffResources  DiscCauseExt = 1033
	DiscCauseExtPPPLCPTimeout      DiscCauseExt = 1040
	DiscCauseExtPPPLCPFail         DiscCauseExt = 1041
	DiscCauseExtPPPPapFail         DiscCauseExt = 1042
	DiscCauseExtPPPCHAPFail        DiscCauseExt = 1043
	DiscCauseExtPPPRemoteFail      DiscCauseExt = 1044
	DiscCauseExtPPPReceiveTerm     DiscCauseExt = 1045
	// DiscCauseExtHWPPPAdminClose (1046) is Huawei-only: the upper layer
	// requested the PPP connection be closed. Cisco Table 3 skips 1046.
	DiscCauseExtHWPPPAdminClose      DiscCauseExt = 1046
	DiscCauseExtPPPNoNCP             DiscCauseExt = 1047
	DiscCauseExtPPPMPError           DiscCauseExt = 1048
	DiscCauseExtPPPMaxChannels       DiscCauseExt = 1049
	DiscCauseExtTSTablesFull         DiscCauseExt = 1050
	DiscCauseExtTSResourceFull       DiscCauseExt = 1051
	DiscCauseExtTSInvalidIPAddr      DiscCauseExt = 1052
	DiscCauseExtTSBadHostname        DiscCauseExt = 1053
	DiscCauseExtTSBadPort            DiscCauseExt = 1054
	DiscCauseExtTCPReset             DiscCauseExt = 1060
	DiscCauseExtTCPConnectionRefused DiscCauseExt = 1061
	DiscCauseExtTCPTimeout           DiscCauseExt = 1062
	// DiscCauseExtTCPForeignHostClose (1063) is "tcp-foreign-host-close" per
	// Cisco Table 3. Huawei documents 1063 as "PPP handshake failure"; the
	// Cisco meaning is used here. Callers interoperating with Huawei should
	// treat 1063 as peer-defined.
	DiscCauseExtTCPForeignHostClose     DiscCauseExt = 1063
	DiscCauseExtTCPNetUnreachable       DiscCauseExt = 1064
	DiscCauseExtTCPHostUnreachable      DiscCauseExt = 1065
	DiscCauseExtTCPNetAdminUnreachable  DiscCauseExt = 1066
	DiscCauseExtTCPHostAdminUnreachable DiscCauseExt = 1067
	DiscCauseExtTCPPortUnreachable      DiscCauseExt = 1068
	// DiscCauseExtHWSessionTimeout (1100) is Huawei-only: session timeout.
	// Cisco Table 3 has no 1100 entry.
	DiscCauseExtHWSessionTimeout DiscCauseExt = 1100
)

Disconnect cause extensions (Cisco Table 3).

func (DiscCauseExt) String added in v1.2.0 

func (d DiscCauseExt) String() string

String returns a hyphenated name for the disconnect-cause extension, or "unknown(<n>)" for values outside the defined set.

type HeaderFlags 

type HeaderFlags byte

HeaderFlags is the header flags byte (RFC 8907 §4.2). 

const (
	// FlagUnencrypted indicates the packet body is cleartext. It is deprecated
	// and MUST NOT be used in production over a non-TLS connection (RFC 8907
	// §10.5.2). Under TLS it MUST be set on every packet in both directions
	// (RFC 9887 §4).
	FlagUnencrypted HeaderFlags = 0x01
	// FlagSingleConnect requests single-connection mode, allowing multiple
	// sessions to be multiplexed over one TCP connection (RFC 8907 §4.3).
	FlagSingleConnect HeaderFlags = 0x04
)

Header flag bits (RFC 8907 §4.2).

func (HeaderFlags) Has 

func (f HeaderFlags) Has(flag HeaderFlags) bool

Has reports whether all of the given flag bits are set.

func (HeaderFlags) Valid 

func (f HeaderFlags) Valid() bool

Valid reports whether f uses only defined bits (0x01 and 0x04). Undefined bits MUST be ignored on read and SHOULD be zero on write (RFC 8907 §4.2).

type Logger 

type Logger interface {
	// Enabled reports whether the given level would be emitted under the
	// given context.
	Enabled(ctx context.Context, level slog.Level) bool
	// Debug logs at Debug level with key-value pairs.
	Debug(msg string, args ...any)
	// Info logs at Info level with key-value pairs.
	Info(msg string, args ...any)
	// Warn logs at Warn level with key-value pairs.
	Warn(msg string, args ...any)
	// Error logs at Error level with key-value pairs.
	Error(msg string, args ...any)
	// Log logs at the given level with context and key-value pairs.
	Log(ctx context.Context, level slog.Level, msg string, args ...any)
	// With returns a Logger annotated with key-value pairs (alternating key,
	// value arguments, matching slog.Logger.With).
	With(args ...any) Logger
	// WithGroup returns a Logger with the given group name.
	WithGroup(name string) Logger
}

Logger is the structured logging interface used by the library core. It is signature-compatible with a subset of *slog.Logger, so a *slog.Logger (or any adapter satisfying this interface) can be injected. Callers pass msg string, args ...any where args are alternating key/value pairs, and levels use slog.Level (slog.LevelDebug, slog.LevelInfo, slog.LevelWarn, slog.LevelError).

func NopLogger 

func NopLogger() Logger

NopLogger returns a Logger that discards all output. It is the default logger used when no logger is configured.

func WithFunc added in v1.1.0 

func WithFunc(l Logger, name string) Logger

WithFunc returns a Logger annotated with a "func" field naming the caller using the dotted path from the module root (e.g. "packet.Header.Marshal"). It is a convenience wrapper for the project-wide "func" field convention, equivalent to l.With("func", name).

type PacketType 

type PacketType byte

PacketType identifies the kind of TACACS+ packet (header byte 1). 

const (
	PacketAuthentication PacketType = 0x01
	PacketAuthorization  PacketType = 0x02
	PacketAccounting     PacketType = 0x03
)

Packet types (RFC 8907 §4.1).

func (PacketType) String 

func (t PacketType) String() string

String returns a human-readable name for the packet type.

func (PacketType) Valid 

func (t PacketType) Valid() bool

Valid reports whether t is a defined packet type.

type PrivLevel 

type PrivLevel byte

PrivLevel is the privilege level, an ordered value in the range 0..15 (RFC 8907 §9). Each level is a superset of the next lower level. 

const (
	// PrivLevelMin is the privilege of an unauthenticated session.
	PrivLevelMin PrivLevel = 0x00
	// PrivLevelUser is the privilege of a regular authenticated session.
	PrivLevelUser PrivLevel = 0x01
	// PrivLevelRoot is a highly privileged level.
	PrivLevelRoot PrivLevel = 0x0f
	// PrivLevelMax is the highest privilege level (same value as Root).
	PrivLevelMax PrivLevel = 0x0f
)

Privilege levels (RFC 8907 §9).

type Version 

type Version byte

Version is the packed header version byte (major<<4 | minor). 

const (
	// VersionDefault is major 0xc | minor 0x0.
	VersionDefault Version = 0xc0
	// VersionOne is major 0xc | minor 0x1.
	VersionOne Version = 0xc1
)

Packed version byte values.

func (Version) Major 

func (v Version) Major() byte

Major returns the major version nibble.

func (Version) Minor 

func (v Version) Minor() byte

Minor returns the minor version nibble.

func (Version) Valid 

func (v Version) Valid() bool

Valid reports whether v is a supported TACACS+ version byte.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.