First draft of CUI policies

Taken from http://github.com/twoln/freeradius-server/
with edits for consistency and clarity

diff --git a/raddb/modules/cui b/raddb/modules/cui
new file mode 100644 (file)
index 0000000..8353b90
--- /dev/null
+++ b/raddb/modules/cui
@@ -0,0 +1,25 @@
+# -*- text -*-
+#
+#  $Id$
+
+#
+#  Write Chargeable-User-Identity to the database.
+#
+#  Schema      raddb/sql/mysql/cui.sql
+#  Queries     raddb/sql/mysql/cui.conf
+#
+sql cui {
+       database = "mysql"
+       driver = "rlm_sql_${database}"
+       server = "localhost"
+       login = "db_login_name"
+       password = "db_password"
+       radius_db = "db_name"
+#      sqltrace = yes
+#      sqltracefile = ${logdir}/cuitrace.sql
+       num_sql_socks = 5
+       connect_failure_retry_delay = 60
+       cui_table = "cui"
+       sql_user_name = "%{User-Name}"
+       $INCLUDE sql/${database}/cui.conf
+}

diff --git a/raddb/policy.conf b/raddb/policy.conf
index d7c89d9..f89eb3f 100644 (file)
--- a/raddb/policy.conf
+++ b/raddb/policy.conf
@@ -63,4 +63,72 @@ policy {
 
                handled
        }
+
+       #       
+       #  The following policies are for the Chargeable-User-Identity
+       #  (CUI) configuration.
+       #
+
+       #
+       #  The client indicates it can do CUI by sending a CUI attribute        
+       #  containing one zero byte
+       #
+       cui_authorize {
+               update request {
+                       Chargeable-User-Identity:='\\000'
+               }
+       }
+
+       #
+       #  Add a CUI attribute based on the User-Name, and a secret key
+       #  known only to this server.
+       #
+       cui_postauth {
+               if (FreeRadius-Proxied-To == 127.0.0.1) {
+                       if (outer.request:Chargeable-User-Identity) {
+                               update outer.reply {
+                                       Chargeable-User-Identity:="%{md5:%{config:cui_hash_key}%{User-Name}}"
+                               }
+                       }
+               }
+               else {
+                       if (Chargeable-User-Identity) {
+                               update reply {
+                                       Chargeable-User-Identity="%{md5:%{config:cui_hash_key}%{User-Name}}"
+                               }
+                       }
+               }
+       }
+
+       #
+       #  If there is a CUI attribute in the reply, add it to the DB.
+       #
+       cui_updatedb {
+               if (reply:Chargeable-User-Identity) {
+                       cui
+               }
+       }
+
+       #
+       #  If we had stored a CUI for the User, add it to the request.
+       #
+       cui_accounting {
+               #
+               #  If the CUI isn't in the packet, see if we can find it
+               #  in the DB.
+               #
+               if (!Chargeable-User-Identity) {
+                       update control {
+                               Chargable-User-Identity := "%{cui: SELECT cui FROM cui WHERE clientipaddress = '%{Client-IP-Address}' AND callingstationid = '%{Calling-Station-Id}' AND username = '%{User-Name}'}"
+                       }
+               }
+
+               #
+               #  If it exists now, then write out when we last saw
+               #  this CUI.
+               #
+               if (Chargeable-User-Identity && (Chargeable-User-Identity != "")) {
+                       cui
+               }
+       }
 }

diff --git a/raddb/sql/mysql/cui.conf b/raddb/sql/mysql/cui.conf
new file mode 100644 (file)
index 0000000..eb7cfca
--- /dev/null
+++ b/raddb/sql/mysql/cui.conf
@@ -0,0 +1,31 @@
+# -*- text -*-
+
+##
+##  Queries to update the CUI table.
+##
+postauth_query = "INSERT IGNORE INTO ${cui_table} \
+       (clientipaddress, callingstationid, username, cui, lastaccounting) \
+        VALUES \
+       ('%{Client-IP-Address}', '%{Calling-Station-Id}', '%{User-Name}', '%{reply:Chargeable-User-Identity}', NULL) ON DUPLICATE KEY UPDATE lastaccounting='0000-00-00 00:00:00', cui='%{reply:Chargeable-User-Identity}'";
+
+accounting_start_query = "UPDATE ${cui_table} \
+       SET \
+                lastaccounting = CURRENT_TIMESTAMP \
+       WHERE clientipaddress = '%{Client-IP-Address}' \
+        AND callingstationid = '%{Calling-Station-Id}' \
+        AND username = '%{User-Name}' \
+       AND cui = '%{Chargeable-User-Identity}'";
+  
+accounting_update_query = "UPDATE ${cui_table} \
+       SET \
+                lastaccounting = CURRENT_TIMESTAMP \
+       WHERE clientipaddress = '%{Client-IP-Address}' \
+        AND callingstationid = '%{Calling-Station-Id}' \
+        AND username = '%{User-Name}' \
+       AND cui = '%{Chargeable-User-Identity}'";
+
+accounting_stop_query = "DELETE FROM ${cui_table} WHERE \
+       clientipaddress = '%{Client-IP-Address}' \
+       AND callingstationid = '%{Calling-Station-Id}' \
+       AND username = '%{User-Name}' \
+       AND cui = '%{Chargeable-User-Identity}'";

diff --git a/raddb/sql/mysql/cui.sql b/raddb/sql/mysql/cui.sql
new file mode 100644 (file)
index 0000000..cd1ca72
--- /dev/null
+++ b/raddb/sql/mysql/cui.sql
@@ -0,0 +1,9 @@
+CREATE TABLE `cui` (
+  `clientipaddress` varchar(15) NOT NULL default '',
+  `callingstationid` varchar(50) NOT NULL default '',
+  `username` varchar(64) NOT NULL default '',
+  `cui` varchar(32) NOT NULL default '',
+  `creationdate` timestamp NOT NULL default CURRENT_TIMESTAMP,
+  `lastaccounting` timestamp NOT NULL default '0000-00-00 00:00:00',
+  PRIMARY KEY  (`username`,`clientipaddress`,`callingstationid`)
+) ENGINE=MyISAM DEFAULT CHARSET=latin1;