search

inverse-inc / packetfence

PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, powerful BYOD management options, 802.1X support, layer-2 isolation of problematic devices; PacketFence can be used to effectively secure networks small to very large heterogeneous networks.
https://packetfence.org
GNU General Public License v2.0
1.39k stars 291 forks source link

Parse RADIUS request attributes during Redis cache extraction #8380

Open E-ThanG opened 3 weeks ago

E-ThanG commented 3 weeks ago

Description

Parse RADIUS attributes WLAN-AKM-Suite, WLAN-Group-Cipher, WLAN-Pairwise-Cipher, TLS-Cert-Expiration, TLS-Cert-Valid-Since, TLS-Client-Cert-Expiration, and TLS-Client-Cert-Valid-Since into human readable strings.

Addresses issue where WLAN AKM and Cipher suite information integer value is displayed as a float64.

Note: Parsing could be done elsewhere, however, the pfcron flush task is one of the last locations where the RADIUS information is still in JSON and not a formatted string. It's relatively easy to manipulate now. Having said that, from a resource utilization perspective it may make more sense to perform this task as a particular RADIUS log entry is requested from the Admin UI.

Also, there may be additional attributes that would be nice to have parsed. I can add more if desired. The EAP-Message is perhaps a reasonable addition.

Impacts

Usability of information presented in Admin UI RADIUS audit log

Issue

fixes #8358

Delete branch after merge

YES

Checklist

Enhancements

Added parsing of WLAN-AKM-Suite, WLAN-Group-Cipher, WLAN-Pairwise-Cipher, TLS-Cert-Expiration, TLS-Cert-Valid-Since, TLS-Client-Cert-Expiration, and TLS-Client-Cert-Valid-Since attributes.

WLAN AKM and Cipher Suite attributes are decoded and filled with the name of the AKM or suite used. Dates are presented in a human-readable format with 4-digit year.

Existing behavior with WLAN attributes is that the integers are erroneously unmarshaled as Float64 by Golang json.Unmarshal. Date's are presented as a string with 2-digit year and no field delimiters or spacing ("241025235210Z").

Example of change as viewed from Admin UI:

TLS-Cert-Expiration = "2039-04-10 17:00:00",
TLS-Cert-Valid-Since = "2019-04-10 16:51:00",
TLS-Client-Cert-Expiration = "2029-09-27 21:14:28",
TLS-Client-Cert-Valid-Since = "2024-09-27 21:04:00",
WLAN-AKM-Suite = "FT over 802.1X",
WLAN-Group-Cipher = "CCMP-128",
WLAN-Pairwise-Cipher = "CCMP-128"

image

E-ThanG commented 23 hours ago

Can you think of other attributes that it would be handy to include parsing of?