Open ITMPGIT opened 2 months ago
Important notices
Before you add a new report, we ask you kindly to acknowledge the following:
Describe the bug
I used the captive portal with authentication on an external freeradius and mysql server. In my tests I noticed that the opnsense captive portal does not send all the fields that in theory would be standard (rfc3580) for accounting storage, such as:
Tip: to validate your setup was working with the previous version, use opnsense-revert (https://docs.opnsense.org/manual/opnsense_tools.html#opnsense-revert)
To Reproduce
Steps to reproduce the behavior:
standard captive configuration with default template and freeradius authentication Expected behavior
record client and nas mac addresses
Relevant log files
using tcpdump it is possible to check that the fields containing the mac address are not passed during authentication via captive portal.
tcpdump: listening on em0, link-type EN10MB (Ethernet), snapshot length 262144 bytes 13:21:58.620479 IP (tos 0x0, ttl 64, id 40615, offset 0, flags [none], proto UDP (17), length 110) 192.168.1.72.52807 > x.x.x.x.radius: [udp sum ok] RADIUS, length: 82 Access-Request (1), id: 0x43, Authenticator: xxxxxx6ab5b4888c75 User-Name Attribute (1), length: 5, Value: eee 0x0000: 6565 65 Service-Type Attribute (6), length: 6, Value: Login 0x0000: 0000 0001 Framed-Protocol Attribute (7), length: 6, Value: #15 0x0000: 0000 000f NAS-Identifier Attribute (32), length: 15, Value: 66d20a8ae1a23 0x0000: 3636 6432 3061 3861 6531 6132 33 NAS-Port Attribute (5), length: 6, Value: 0 0x0000: 0000 0000 NAS-Port-Type Attribute (61), length: 6, Value: Ethernet 0x0000: 0000 000f User-Password Attribute (2), length: 18, Value: 0x0000: 3e25 757f xxxx 0e4e 0480 88bd a88e 7ada 13:21:59.726935 IP (tos 0x0, ttl 48, id 36673, offset 0, flags [none], proto UDP (17), length 66) xxxx.radius > 192.168.1.72.52807: [udp sum ok] RADIUS, length: 38 Access-Reject (3), id: 0x43, Authenticator: b0900ec93f1011eefc6c934919e0323a Message-Authenticator Attribute (80), length: 18, Value: .!.*V$.f...a.... 0x0000: 1d21 a62a 5624 ed66 0c1a 1b61 01f4 f208
Additional context
using the same tests but with pfsense 2.7 the fields are passed correctly
Environment
Software version used and hardware type if relevant, e.g.:
OPNsense 24.7.3_1-amd64 FreeBSD 14.1-RELEASE-p3 OpenSSL 3.0.14 AMD Ryzen 5 5600 Realtek 8832AU Wireless LAN WiFi 6 USB NIC
here are some lines you can check and maybe create an PR?
https://github.com/opnsense/core/blob/e40596e16e3224746a0f6146ffd07015412b4645/src/opnsense/mvc/app/controllers/OPNsense/CaptivePortal/Api/AccessController.php#L150
https://github.com/opnsense/core/blob/e40596e16e3224746a0f6146ffd07015412b4645/src/opnsense/mvc/app/library/OPNsense/Auth/Radius.php#L197
Important notices
Before you add a new report, we ask you kindly to acknowledge the following:
Describe the bug
I used the captive portal with authentication on an external freeradius and mysql server. In my tests I noticed that the opnsense captive portal does not send all the fields that in theory would be standard (rfc3580) for accounting storage, such as:
Tip: to validate your setup was working with the previous version, use opnsense-revert (https://docs.opnsense.org/manual/opnsense_tools.html#opnsense-revert)
To Reproduce
Steps to reproduce the behavior:
standard captive configuration with default template and freeradius authentication Expected behavior
record client and nas mac addresses
Relevant log files
using tcpdump it is possible to check that the fields containing the mac address are not passed during authentication via captive portal.
Additional context
using the same tests but with pfsense 2.7 the fields are passed correctly
Environment
Software version used and hardware type if relevant, e.g.:
OPNsense 24.7.3_1-amd64 FreeBSD 14.1-RELEASE-p3 OpenSSL 3.0.14 AMD Ryzen 5 5600 Realtek 8832AU Wireless LAN WiFi 6 USB NIC