Hi, I am trying to make the SoH statements to work using the FreeRADIUS DHCP. However, I have issues to get the SoH values from the NAP client. Maybe someone will be able to help. On the client side, the DHCP NAP policy is set to enabled. Thanks! sites-enabled/dhcp : listen { ipaddr = * port = 67 type = dhcp # interface = eth0 broadcast = yes } dhcp DHCP-Discover { soh update reply { DHCP-Message-Type = DHCP-Offer } # The contents here are invented. Change them! update reply { DHCP-Domain-Name-Server = 4.2.2.2 DHCP-Domain-Name-Server = 4.2.2.1 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.0.0.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.0.0.243 } mac2ip ok } dhcp DHCP-Request { soh update reply { DHCP-Message-Type = DHCP-Ack } # The contents here are invented. Change them! update reply { DHCP-Domain-Name-Server = 4.2.2.2 DHCP-Domain-Name-Server = 4.2.2.1 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.0.0.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.0.0.243 } mac2ip ok } dhcp { # send a DHCP NAK. reject } } passwd mac2ip { filename = ${confdir}/mac2ip format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address" delimiter = "," } The Debug : Received DHCP-Discover of id 6922f808 from 0.0.0.0:68 to 0.0.0.0:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 1763899400 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = f0:4d:a2:cb:d9:c5 DHCP-Message-Type = DHCP-Discover DHCP-Client-Identifier = f0:4d:a2:cb:d9:c5 DHCP-Hostname = "TestingLaptop" DHCP-Vendor-Class-Identifier = "MSFT 5.0" DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS-Node-Type DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Perform-Router-Discovery DHCP-Parameter-Request-List = DHCP-Static-Routes DHCP-Parameter-Request-List = DHCP-Classless-Static-Route DHCP-Parameter-Request-List = 249 DHCP-Parameter-Request-List = DHCP-Vendor DHCP-Vendor = 0xdc00 server dhcp { Trying sub-section dhcp DHCP-Discover {...} +- entering group DHCP-Discover {...} [soh] SoH adding NAP marker to DHCP reply ++[soh] returns ok ++[reply] returns ok ++[reply] returns ok [mac2ip] Added DHCP-Your-IP-Address: '10.0.0.245' to reply_items ++[mac2ip] returns ok ++[ok] returns ok } # server dhcp Sending DHCP-Offer of id 6922f808 from 0.0.0.0:67 to 255.255.255.255:68 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.0.0.1 DHCP-Domain-Name-Server = 4.2.2.2 DHCP-Vendor = 0xdc0350414e DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.0.0.243 Finished request 1767. Cleaning up request 1767 ID 1763899400 with timestamp +76404 Going to the next request Ready to process requests. Received DHCP-Request of id 6922f808 from 0.0.0.0:68 to 0.0.0.0:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 1763899400 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = f0:4d:a2:cb:d9:c5 DHCP-Message-Type = DHCP-Request DHCP-Client-Identifier = f0:4d:a2:cb:d9:c5 DHCP-Requested-IP-Address = 10.0.0.245 DHCP-DHCP-Server-Identifier = 10.0.0.243 DHCP-Hostname = "TestingLaptop" DHCP-Client-FQDN = "\000\000\000TestingLaptop.inverse.local" DHCP-Vendor-Class-Identifier = "MSFT 5.0" DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS-Node-Type DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Perform-Router-Discovery DHCP-Parameter-Request-List = DHCP-Static-Routes DHCP-Parameter-Request-List = DHCP-Classless-Static-Route DHCP-Parameter-Request-List = 249 DHCP-Parameter-Request-List = DHCP-Vendor server dhcp { Trying sub-section dhcp DHCP-Request {...} +- entering group DHCP-Request {...} ++[soh] returns noop ++[reply] returns noop ++[reply] returns noop [mac2ip] Added DHCP-Your-IP-Address: '10.0.0.245' to reply_items ++[mac2ip] returns ok ++[ok] returns ok } # server dhcp Sending DHCP-Ack of id 6922f808 from 0.0.0.0:67 to 255.255.255.255:68 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.0.0.1 DHCP-Domain-Name-Server = 4.2.2.2 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.0.0.243 Finished request 1768. -- Francois Gaudreault, ing. jr fgaudreault@inverse.ca :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)
On 07/20/2011 06:07 PM, Francois Gaudreault wrote:
Hi,
I am trying to make the SoH statements to work using the FreeRADIUS DHCP. However, I have issues to get the SoH values from the NAP client. Maybe someone will be able to help.
On the client side, the DHCP NAP policy is set to enabled.
Unfortunately the SoH DHCP code is unlikely to work very well - I didn't quite finish it. The problem is twofold; first, the SoH payloads are >255 bytes (the max size of a DHCP option) so support for DHCP option "continuation" is needed; this is doubly tedious because Microsoft use a non-standard format for option continuation (main option followed by one or more option 240 IIRC) The second problem is that the constituent DHCP option(s) are themselves each >253 bytes, which means they are too big to fit inside a VALUE_PAIR structure (which is sized for radius attributes, not DHCP attributes). This means there are two unpalatable choices: 1. Change the VALUE_PAIR union to include a "char dhcpopt[255]" member 2. Decode DHCP options differently based on length; if <= 253, decode into the "octets" member of VALUE_PAIR; if >253, decode into the "tlv" pointer-indirection method. This seems... dirty, since you're basically using the tlv pointer for options of length 254 or 255 only (although you might want to decode option continuation into the same buffer I guess?) Basically, some code needs adding to the DHCP portion of FreeRADIUS to handle DHCP option continuation, and options >253 bytes, before the SoH code will work with DHCP. I don't have much time at the moment, but I might see if I can get this working tomorrow. Cheers, Phil
Hey Phil, Any chance you have some developments about that DHCP SoH thing? -- Francois Gaudreault, ing. jr fgaudreault@inverse.ca :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)
Hi Phil, It's been a while since we did not receive feedbacks about that SoH and DHCP enforcement. I am just wandering if you had some news about it. Thanks! On 11-07-20 2:36 PM, Phil Mayers wrote:
On 07/20/2011 06:07 PM, Francois Gaudreault wrote:
Hi,
I am trying to make the SoH statements to work using the FreeRADIUS DHCP. However, I have issues to get the SoH values from the NAP client. Maybe someone will be able to help.
On the client side, the DHCP NAP policy is set to enabled.
Unfortunately the SoH DHCP code is unlikely to work very well - I didn't quite finish it.
The problem is twofold; first, the SoH payloads are >255 bytes (the max size of a DHCP option) so support for DHCP option "continuation" is needed; this is doubly tedious because Microsoft use a non-standard format for option continuation (main option followed by one or more option 240 IIRC)
The second problem is that the constituent DHCP option(s) are themselves each >253 bytes, which means they are too big to fit inside a VALUE_PAIR structure (which is sized for radius attributes, not DHCP attributes). This means there are two unpalatable choices:
1. Change the VALUE_PAIR union to include a "char dhcpopt[255]" member 2. Decode DHCP options differently based on length; if <= 253, decode into the "octets" member of VALUE_PAIR; if >253, decode into the "tlv" pointer-indirection method. This seems... dirty, since you're basically using the tlv pointer for options of length 254 or 255 only (although you might want to decode option continuation into the same buffer I guess?)
Basically, some code needs adding to the DHCP portion of FreeRADIUS to handle DHCP option continuation, and options >253 bytes, before the SoH code will work with DHCP.
I don't have much time at the moment, but I might see if I can get this working tomorrow.
Cheers, Phil - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Francois Gaudreault, ing. jr fgaudreault@inverse.ca :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)
On 09/20/2011 06:15 PM, Francois Gaudreault wrote:
Hi Phil,
It's been a while since we did not receive feedbacks about that SoH and DHCP enforcement. I am just wandering if you had some news about it.
Sorry; I've no time to look into it at the moment. Personal real-life issues are consuming all my time.
That's fine, I understand that. On 11-09-20 1:56 PM, Phil Mayers wrote:
On 09/20/2011 06:15 PM, Francois Gaudreault wrote:
Hi Phil,
It's been a while since we did not receive feedbacks about that SoH and DHCP enforcement. I am just wandering if you had some news about it.
Sorry; I've no time to look into it at the moment. Personal real-life issues are consuming all my time. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Francois Gaudreault, ing. jr fgaudreault@inverse.ca :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)
participants (2)
-
Francois Gaudreault -
Phil Mayers