Hi all, I would like to insert a check on users' MAC address operated by freeRADIUS. The objective is to allow users to use only one MAC address to gain access to a Wi-Fi network. The new query will check if user's MAC address is the same of his first access, and deny access if he is using a different one. To do this a new query needs to be inserted into /raddb/sql.conf to perform this check in the authentication process, and the src/modules/rlm_sql/rlm_sql.c needs to be modified. Writing the new query is not a problem, but modifying rlm_sql.c seems to be not so easy. Could somebody give indication on how to do this in order to speed up development process? A description of information flow (variables/funtions/pointers) into rlm_sql.c might be useful. Thank you in advance, Best regards, Carlo
On Thu, Feb 02, 2006 at 10:32:53AM +0100, Carlo Prestopino wrote:
Hi all,
I would like to insert a check on users' MAC address operated by freeRADIUS.
The objective is to allow users to use only one MAC address to gain access to a Wi-Fi network. The new query will check if user's MAC address is the same of his first access, and deny access if he is using a different one.
To do this a new query needs to be inserted into /raddb/sql.conf to perform this check in the authentication process, and the src/modules/rlm_sql/rlm_sql.c needs to be modified.
Erk. Why not just make it a check-item (and somehow pass it if the item is absent) and use the post-auth SQL hook to insert the Mac address into the relevant table? -- ----------------------------------------------------------- Paul "TBBle" Hampson, Bsc, MCSE On-hiatus Asian Studies student, ANU The Boss, Bubblesworth Pty Ltd (ABN: 51 095 284 361) Paul.Hampson@Pobox.Com Of course Pacman didn't influence us as kids. If it did, we'd be running around in darkened rooms, popping pills and listening to repetitive music. -- Kristian Wilson, Nintendo, Inc, 1989 License: http://creativecommons.org/licenses/by/2.1/au/ -----------------------------------------------------------
My environment is freeRADIUS 1.1.0 with mySQL 5.0. MySQ 5.0 support stored procedures and function, so I've defined a function called mac_check as follows: CREATE FUNCTION `mac_check`(utente VARCHAR(20),mac VARCHAR(30)) RETURNS varchar(50) DETERMINISTIC BEGIN IF (SELECT (SELECT MAX((Attribute='Calling-Station-Id')) from radcheck WHERE UserName=utente)) THEN RETURN 'record already present'; END IF; INSERT INTO radcheck (UserName,Attribute,op,Value) VALUES (utente,'Calling-Station-Id',':=', mac); RETURN 'record inserted'; END The function mac_check controls if Calling-Station-Id is already present into radcheck table for key "utente", if not "mac" will be inserted. The function will then be called from raddb/sql.conf simply modifying the content of postauth_query: was postauth_query = "INSERT into ${postauth_table} (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" become postauth_query = "SELECT mac_check(${postauth_table}, %{User-Name}, %{User-Password:-Chap-Password}, %{reply:Packet-Type}, %{Called-Station-Id})" in this way I lost the entry into radpostauth table, but this is not a big problem. I've modified the postauth_query thinking that, acting like this, no modifications where necessary to rlm_sql.c file. In fact, if I change the INSERT into postauth_query with a different one, this work pretty good. Unfortunately things seem to work in a dufferent way, because the mac_check function is not recognized by freeRADIUS: from logs I can see that it is not executed.... ;-( I suppose that there is something to change into rlm_sql.c file.... Any advice? Thank you in advance Carlo
Carlo Prestopino wrote:
CREATE FUNCTION `mac_check`(utente VARCHAR(20),mac VARCHAR(30)) RETURNS varchar(50)
The mac_check function is defined to accept 2 arguments. (utente and mac)
postauth_query = "SELECT mac_check(${postauth_table}, %{User-Name}, %{User-Password:-Chap-Password}, %{reply:Packet-Type}, %{Called-Station-Id})"
Here the mac_check function is called with 5 arguments. -- Nicolas Baradakis
Yes, it's ok. I've simply made a mistake in cut/paste operations. The corret one is as follows CREATE FUNCTION `mac_check`(utente VARCHAR(20),mac VARCHAR(30)) RETURNS varchar(50) DETERMINISTIC BEGIN IF (SELECT (SELECT MAX((Attribute='Calling-Station-Id')) from radcheck WHERE UserName=user)) THEN #INSERT into radpostauth (id, user, pass, reply, date) values ('', utente, passwd,reply_packet, NOW()); RETURN 'record already present'; END IF; INSERT INTO radcheck (UserName,Attribute,op,Value) VALUES (utente,'Calling-Station-Id',':=', mac); RETURN 'record inserted'; END The five arguments one is because I tried to change the content of postauth_query with a function that have to perform two actions: - INSERT into radcheck (needed to perform MAC control) - INSERT into radpostauth (original behaviour of postauth_query) Regards, Carlo
rlm_perl -- Groeten, Regards, Salutations, Thor Spruyt M: +32 (0)475 67 22 65 E: thor.spruyt@telenet.be W: www.thor-spruyt.com www.salesguide.be www.telenethotspot.be ----- Original Message ----- From: Carlo Prestopino To: freeradius-devel@lists.freeradius.org Sent: Thursday, February 02, 2006 10:32 AM Subject: rlm_sql Hi all, I would like to insert a check on users' MAC address operated by freeRADIUS. The objective is to allow users to use only one MAC address to gain access to a Wi-Fi network. The new query will check if user's MAC address is the same of his first access, and deny access if he is using a different one. To do this a new query needs to be inserted into /raddb/sql.conf to perform this check in the authentication process, and the src/modules/rlm_sql/rlm_sql.c needs to be modified. Writing the new query is not a problem, but modifying rlm_sql.c seems to be not so easy. Could somebody give indication on how to do this in order to speed up development process? A description of information flow (variables/funtions/pointers) into rlm_sql.c might be useful. Thank you in advance, Best regards, Carlo ------------------------------------------------------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
participants (4)
-
Carlo Prestopino -
Nicolas Baradakis -
Paul TBBle Hampson -
Thor Spruyt