search

OpenVPN-Community / openvpn-radiusplugin

GNU General Public License v2.0
6 stars 1 forks source link

Allow specifying NAS-Port and NAS-Port-Id #1

Open alex-dot opened 4 years ago

alex-dot commented 4 years ago

Currently this plugin allows specifying NAS-Port-Type. Can you also allow specifying NAS-Port and NAS-Port-Id?

By @johnnybubonic

alex-dot commented 4 years ago

The addition of more variables should be possible. NAS-Port should be configurable as a number between 0 and 4095.

However, I do not find a specific definition of NAS-Port-Id in the relevant RFCs, although I do find it referenced in RFC3579, which is the EAP extension of RADIUS. EAP should be implemented by this plugin (and OpenVPN at large) at some point, true, but what good does an exposed NAS-Port-Id attribute do, if the client does not speak EAP? What is the use-case here?

johnnybubonic commented 4 years ago

@alex-dot NAS-Port-Id was (I believe) originally defined in 2869 § 5.17, and is a string identifier used in accounting identification.

NAS-Port was originally defined in 2865 § 5.5 and is an integer as mentioned, and is used as an identifier in session identification.

I can make do with one or both since I'm using FreeRADIUS for my server and thus have a significant amount of flexibility when it comes to logic there. However, those using something like Cisco kit for their RADIUS provider may not have that amount of flexibility and may require both to have effective accounting and session tracking across e.g. multiple OpenVPN daemons running on the same NAS - otherwise session tracking and accounting cannot distinguish between multiple OpenVPN daemons on the same host. Does that help?

alex-dot commented 4 years ago

Yes, that helps a lot.

@josephholsten and I are currently in the process to consolidate all the different forks of this plugin and to unify the efforts. Perhaps we can interest you in helping out?

Either way, there is currently no ETA for this issue.

johnnybubonic commented 4 years ago

sure, i'll help how i can! i don't know much development besides python, so i probably won't be able to make recommendations for code, but i know some RADIUS and can at least TL;DR RFC's for you!