net/freeradius: add extended logging and daily session limit (#377)

net/freeradius/Makefile

@@ -1,5 +1,5 @@
 PLUGIN_NAME=		freeradius
-PLUGIN_VERSION=		1.2.1
+PLUGIN_VERSION=		1.3.0
 PLUGIN_COMMENT=		RADIUS Authentication, Authorization and Accounting Server
 PLUGIN_DEPENDS=		freeradius3
 PLUGIN_MAINTAINER=	m.muenz@gmail.com

net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/dialogEditFreeRADIUSUser.xml

@@ -77,4 +77,10 @@
         <type>text</type>
         <help>Set the maximum download bandwith for ChilliSpot attribute. The value is treated as kbits/s.</help>
     </field>
+    <field>
+        <id>user.sessionlimit_max_session_limit</id>
+        <label>Max Daily Session</label>
+        <type>text</type>
+        <help>Set the maximum session limit in seconds. This can be used by the Captive Portal.</help>
+    </field>
 </form>

net/freeradius/src/opnsense/mvc/app/controllers/OPNsense/Freeradius/forms/general.xml

@@ -23,4 +23,34 @@
         <type>checkbox</type>
         <help>This enables the ChilliSpot attributes assignment via users tab.</help>
     </field>
+    <field>
+        <id>general.sessionlimit</id>
+        <label>Enable Daily Session Limit</label>
+        <type>checkbox</type>
+        <help>This enables the Max-Daily-Session attribute assignment via users tab.</help>
+    </field>
+     <field>
+        <id>general.log_destination</id>
+        <label>Log to File or Syslog</label>
+        <type>dropdown</type>
+        <help>Set where to log radius requests, defaults to file.</help>
+    </field>
+     <field>
+        <id>general.log_authentication_request</id>
+        <label>Log Authentication Request</label>
+        <type>checkbox</type>
+        <help>Enable the logging of authentication requests, including MAC addresses.</help>
+    </field>
+     <field>
+        <id>general.log_authbadpass</id>
+        <label>Log Authentication Bad Password</label>
+        <type>checkbox</type>
+        <help>Logs password if it is rejected.</help>
+    </field>
+     <field>
+        <id>general.log_authgoodpass</id>
+        <label>Log Authentication Good Password</label>
+        <type>checkbox</type>
+        <help>Logs password if it is correct.</help>
+    </field>
 </form>

net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/General.xml

@@ -19,5 +19,29 @@
             <default>0</default>
             <Required>N</Required>
         </chillispot>
+        <sessionlimit type="BooleanField">
+            <default>0</default>
+            <Required>N</Required>
+        </sessionlimit>
+        <log_destination type="OptionField">
+            <default>files</default>
+            <Required>Y</Required>
+            <OptionValues>
+                <files>files</files>
+                <syslog>syslog</syslog>
+            </OptionValues>    
+        </log_destination>
+        <log_authentication_request type="BooleanField">
+            <default>0</default>
+            <Required>N</Required>
+        </log_authentication_request>
+        <log_authbadpass type="BooleanField">
+            <default>0</default>
+            <Required>N</Required>
+        </log_authbadpass>
+        <log_authgoodpass type="BooleanField">
+            <default>0</default>
+            <Required>N</Required>
+        </log_authgoodpass>
     </items>
 </model>

net/freeradius/src/opnsense/mvc/app/models/OPNsense/Freeradius/User.xml

@@ -63,6 +63,10 @@
                                 <default></default>
                                 <Required>N</Required>
                         </chillispot_bw_max_down>
+                        <sessionlimit_max_session_limit type="IntegerField">
+                                <default></default>
+                                <Required>N</Required>
+                        </sessionlimit_max_session_limit>
             </user>
         </users>
     </items>

net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/+TARGETS

@@ -1,6 +1,8 @@
 clients.conf:/usr/local/etc/raddb/clients.conf
+dictionary:/usr/local/etc/raddb/dictionary
 mods-enabled-eap:/usr/local/etc/raddb/mods-enabled/eap
 radiusd:/etc/rc.conf.d/radiusd
+radiusd.conf:/usr/local/etc/raddb/radiusd.conf
 sites-enabled-default:/usr/local/etc/raddb/sites-enabled/default
 sites-enabled-inner-tunnel:/usr/local/etc/raddb/sites-enabled/inner-tunnel
 users:/usr/local/etc/raddb/mods-config/files/authorize

net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/dictionary

@@ -0,0 +1,2 @@
+#ATTRIBUTE       Daily-Session-Time      3000    integer
+ATTRIBUTE       Max-Daily-Session       3001    integer

net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/mods-enabled-counter

@@ -0,0 +1,85 @@
+{% if helpers.exists('OPNsense.freeradius.general.enabled') and OPNsense.freeradius.general.enabled == '1' %}
+
+# -*- text -*-
+#
+#  $Id: a5ac1e60ef117a2c59ace1a9d061d8f70d1da538 $
+
+#  counter module:
+#  This module takes an attribute (count-attribute).
+#  It also takes a key, and creates a counter for each unique
+#  key.  The count is incremented when accounting packets are
+#  received by the server.  The value of the increment depends
+#  on the attribute type.
+#  If the attribute is Acct-Session-Time or of an integer type we add
+#  the value of the attribute. If it is anything else we increase the
+#  counter by one.
+#
+#  The 'reset' parameter defines when the counters are all reset to
+#  zero.  It can be hourly, daily, weekly, monthly or never.
+#
+#  hourly: Reset on 00:00 of every hour
+#  daily: Reset on 00:00:00 every day
+#  weekly: Reset on 00:00:00 on sunday
+#  monthly: Reset on 00:00:00 of the first day of each month
+#
+#  It can also be user defined. It should be of the form:
+#  num[hdwm] where:
+#  h: hours, d: days, w: weeks, m: months
+#  If the letter is omitted days will be assumed. In example:
+#  reset = 10h (reset every 10 hours)
+#  reset = 12  (reset every 12 days)
+#
+#
+#  The check_name attribute defines an attribute which will be
+#  registered by the counter module and can be used to set the
+#  maximum allowed value for the counter after which the user
+#  is rejected.
+#  Something like:
+#
+#  DEFAULT Max-Daily-Session := 36000
+#          Fall-Through = 1
+#
+#  You should add the counter module in the instantiate
+#  section so that it registers check_name before the files
+#  module reads the users file.
+#
+#  If check_name is set and the user is to be rejected then we
+#  send back a Reply-Message and we log a Failure-Message in
+#  the radius.log
+#
+#  If the count attribute is Acct-Session-Time then on each
+#  login we send back the remaining online time as a
+#  Session-Timeout attribute ELSE and if the reply_name is
+#  set, we send back that attribute.  The reply_name attribute
+#  MUST be of an integer type.
+#
+#  The counter-name can also be used instead of using the check_name
+#  like below:
+#
+#  DEFAULT  Daily-Session-Time > 3600, Auth-Type = Reject
+#      Reply-Message = "You've used up more than one hour today"
+#
+#  The allowed_service_type attribute can be used to only take
+#  into account specific sessions. For example if a user first
+#  logs in through a login menu and then selects ppp there will
+#  be two sessions. One for Login-User and one for Framed-User
+#  service type. We only need to take into account the second one.
+#
+#  The module should be added in the instantiate, authorize and
+#  accounting sections.  Make sure that in the authorize
+#  section it comes after any module which sets the
+#  'check_name' attribute.
+#
+counter daily {
+        filename = ${db_dir}/db.daily
+        key = User-Name
+        count_attribute = Acct-Session-Time
+        reset = daily
+        counter_name = Daily-Session-Time
+        check_name = Max-Daily-Session
+        reply_name = Session-Timeout
+        allowed_service_type = Framed-User
+        cache_size = 5000
+}
+
+{% endif %}

net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/radiusd.conf

@@ -0,0 +1,93 @@
+{% if helpers.exists('OPNsense.freeradius.general.enabled') and OPNsense.freeradius.general.enabled == '1' %}
+
+prefix = /usr/local
+exec_prefix = ${prefix}
+sysconfdir = ${prefix}/etc
+localstatedir = /var
+sbindir = ${exec_prefix}/sbin
+logdir = /var/log
+raddbdir = ${sysconfdir}/raddb
+radacctdir = ${logdir}/radacct
+name = radiusd
+confdir = ${raddbdir}
+modconfdir = ${confdir}/mods-config
+certdir = ${confdir}/certs
+cadir   = ${confdir}/certs
+run_dir = ${localstatedir}/run/${name}
+db_dir = ${raddbdir}
+# libdir ends with an asterisk since package maintainer always appends the current version number to the directory name.
+libdir = /usr/local/lib/freeradius-3*
+pidfile = ${run_dir}/${name}.pid
+correct_escapes = true
+max_request_time = 30
+cleanup_delay = 5
+max_requests = 16384
+hostname_lookups = no
+
+log {
+{% if helpers.exists('OPNsense.freeradius.general.log_destination') and OPNsense.freeradius.general.log_destination != '' %}
+        destination = {{ OPNsense.freeradius.general.log_destination }}
+{% endif %}
+        colourise = yes
+        file = ${logdir}/radius.log
+        syslog_facility = daemon
+        stripped_names = no
+{% if helpers.exists('OPNsense.freeradius.general.log_authentication_request') and OPNsense.freeradius.general.log_authentication_request == '1' %}
+        auth = yes
+{% else %}
+        auth = no
+{% endif %}
+{% if helpers.exists('OPNsense.freeradius.general.log_authbadpass') and OPNsense.freeradius.general.log_authbadpass == '1' %}
+        auth_badpass = yes
+{% else %}
+        auth_badpass = no
+{% endif %}
+{% if helpers.exists('OPNsense.freeradius.general.log_authgoodpass') and OPNsense.freeradius.general.log_authgoodpass == '1' %}        
+        auth_goodpass = yes
+{% else %}
+        auth_goodpass = no
+{% endif %}
+        msg_denied = "You are already logged in - access denied"
+}
+
+checkrad = ${sbindir}/checkrad
+
+security {
+        allow_core_dumps = no
+        max_attributes = 200
+        reject_delay = 1
+        status_server = yes
+
+
+}
+
+proxy_requests  = yes
+$INCLUDE proxy.conf
+$INCLUDE clients.conf
+
+thread pool {
+        start_servers = 5
+        max_servers = 32
+        min_spare_servers = 3
+        max_spare_servers = 10
+        max_requests_per_server = 0
+        auto_limit_acct = no
+}
+
+modules {
+        $INCLUDE mods-enabled/
+}
+
+instantiate {
+{% if helpers.exists('OPNsense.freeradius.general.sessionlimit') and OPNsense.freeradius.general.sessionlimit == '1' %}        
+        daily
+{% endif %}
+}
+
+policy {
+        $INCLUDE policy.d/
+}
+
+$INCLUDE sites-enabled/
+
+{% endif %}

net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/users

@@ -15,7 +15,8 @@
        WISPr-Bandwidth-Min-Down = {{ user_list.wispr_bw_min_down }}{% endif %}{% if user_list.wispr_bw_max_down is defined %},
        WISPr-Bandwidth-Max-Down = {{ user_list.wispr_bw_max_down }}{% endif %}{% if user_list.chillispot_bw_max_up is defined %},
        ChilliSpot-Bandwidth-Max-Up = {{ user_list.chillispot_bw_max_up }}{% endif %}{% if user_list.chillispot_bw_max_down is defined %},
-       ChilliSpot-Bandwidth-Max-Down = {{ user_list.chillispot_bw_max_down }}
+       ChilliSpot-Bandwidth-Max-Down = {{ user_list.chillispot_bw_max_down }}{% endif %}{% if user_list.sessionlimit_max_session_limit is defined %},
+       Max-Daily-Session := {{ user_list.sessionlimit_max_session_limit }}
 {%       endif %}
 
 {%     endif %}