opnsense / core

OPNsense GUI, API and systems backend
https://opnsense.org/
BSD 2-Clause "Simplified" License
3.38k stars 757 forks source link

captive portal does not send Calling Station ID to the client during the connection #7844

Open ITMPGIT opened 2 months ago

ITMPGIT commented 2 months ago

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

Describe the bug

I used the captive portal with authentication on an external freeradius and mysql server. In my tests I noticed that the opnsense captive portal does not send all the fields that in theory would be standard (rfc3580) for accounting storage, such as:

Tip: to validate your setup was working with the previous version, use opnsense-revert (https://docs.opnsense.org/manual/opnsense_tools.html#opnsense-revert)

To Reproduce

Steps to reproduce the behavior:

standard captive configuration with default template and freeradius authentication Expected behavior

record client and nas mac addresses

Relevant log files

using tcpdump it is possible to check that the fields containing the mac address are not passed during authentication via captive portal.

tcpdump: listening on em0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
13:21:58.620479 IP (tos 0x0, ttl 64, id 40615, offset 0, flags [none], proto UDP (17), length 110)
    192.168.1.72.52807 > x.x.x.x.radius: [udp sum ok] RADIUS, length: 82
        Access-Request (1), id: 0x43, Authenticator: xxxxxx6ab5b4888c75
          User-Name Attribute (1), length: 5, Value: eee
            0x0000:  6565 65
          Service-Type Attribute (6), length: 6, Value: Login
            0x0000:  0000 0001
          Framed-Protocol Attribute (7), length: 6, Value: #15
            0x0000:  0000 000f
          NAS-Identifier Attribute (32), length: 15, Value: 66d20a8ae1a23
            0x0000:  3636 6432 3061 3861 6531 6132 33
          NAS-Port Attribute (5), length: 6, Value: 0
            0x0000:  0000 0000
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          User-Password Attribute (2), length: 18, Value:
            0x0000:  3e25 757f xxxx 0e4e 0480 88bd a88e 7ada
13:21:59.726935 IP (tos 0x0, ttl 48, id 36673, offset 0, flags [none], proto UDP (17), length 66)
    xxxx.radius > 192.168.1.72.52807: [udp sum ok] RADIUS, length: 38
        Access-Reject (3), id: 0x43, Authenticator: b0900ec93f1011eefc6c934919e0323a
          Message-Authenticator Attribute (80), length: 18, Value: .!.*V$.f...a....
            0x0000:  1d21 a62a 5624 ed66 0c1a 1b61 01f4 f208

Additional context

using the same tests but with pfsense 2.7 the fields are passed correctly

Environment

Software version used and hardware type if relevant, e.g.:

OPNsense 24.7.3_1-amd64 FreeBSD 14.1-RELEASE-p3 OpenSSL 3.0.14 AMD Ryzen 5 5600 Realtek 8832AU Wireless LAN WiFi 6 USB NIC

skydiablo commented 5 days ago

here are some lines you can check and maybe create an PR?

https://github.com/opnsense/core/blob/e40596e16e3224746a0f6146ffd07015412b4645/src/opnsense/mvc/app/controllers/OPNsense/CaptivePortal/Api/AccessController.php#L150

https://github.com/opnsense/core/blob/e40596e16e3224746a0f6146ffd07015412b4645/src/opnsense/mvc/app/library/OPNsense/Auth/Radius.php#L197