summaryrefslogtreecommitdiffstats
path: root/raddb/policy.d/canonicalization
blob: 1b2f6e3fb3148930db3396b552cbe01480c59ba6 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
#
#	Split User-Name in NAI format (RFC 4282) into components
#
#  This policy writes the Username and Domain portions of the
#  NAI into the Stripped-User-Name and Stripped-User-Domain
#  attributes.
#
#  The regular expression to do this is not strictly compliant
#  with the standard, but it is not possible to write a
#  compliant regexp without perl style regular expressions (or
#  at least not a legible one).
#
nai_regexp = '^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$'

split_username_nai {
	if (&User-Name && (&User-Name =~ /${policy.nai_regexp}/)) {
		update request {
			&Stripped-User-Name := "%{1}"
		}
		
		# Only add the Stripped-User-Domain attribute if
		# we have a domain. This means presence checks
		# for Stripped-User-Domain work.
		if ("%{3}" != '') {
			update request {
				&Stripped-User-Domain = "%{3}"
			}
		}

		# If any of the expansions result in a null
		# string, the update section may return
		# something other than updated...
		updated
	}
	else {
		noop
	}
}

#
#  If called in post-proxy we modify the proxy-reply message
#
split_username_nai.post-proxy {
	if (&proxy-reply:User-Name && (&proxy-reply:User-Name =~ /${policy.nai_regexp}/)) {
		update proxy-reply {
			&Stripped-User-Name := "%{1}"
		}
		
		# Only add the Stripped-User-Domain attribute if
		# we have a domain. This means presence checks
		# for Stripped-User-Domain work.
		if ("%{3}" != '') {
			update proxy-reply {
				&Stripped-User-Domain = "%{3}"
			}
		}
		updated
	}
	else {
		noop
	}
}

#
#  Normalize the MAC Addresses in the Calling/Called-Station-Id
#
mac-addr-regexp = '([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})'

#
#  Add "rewrite_called_station_id" in the "authorize" and
#  "preacct" sections.
#
#  Makes Called-Station-ID conform to what RFC3580 says should
#  be provided by 802.1X authenticators.
#
rewrite_called_station_id {
	if (&Called-Station-Id && (&Called-Station-Id =~ /^${policy.mac-addr-regexp}([^0-9a-f](.+))?$/i)) {
		update request {
			&Called-Station-Id := "%{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}"
			&Called-Station-MAC := "0x%{toupper:%{1}%{2}%{3}%{4}%{5}%{6}}"
		}

		# SSID component?
		if ("%{8}") {
			update request {
				&Called-Station-SSID := "%{8}"
			}
		}
		updated
	}
	else {
		noop
	}
}

#
#  Add "rewrite_calling_station_id" in the "authorize" and
#  "preacct" sections.
#
#  Makes Calling-Station-ID conform to what RFC3580 says should
#  be provided by 802.1X authenticators.
#
rewrite_calling_station_id {
	if (&Calling-Station-Id && (&Calling-Station-Id =~ /^${policy.mac-addr-regexp}$/i)) {
		update request {
			&Calling-Station-Id := "%{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}"
		}
		updated
	}
	else {
		noop
	}
}