forked from c3d2/nix-config
284 lines
7.5 KiB
Plaintext
284 lines
7.5 KiB
Plaintext
# -*- text -*-
|
|
######################################################################
|
|
#
|
|
# This is a virtual server that handles DHCP.
|
|
#
|
|
# !!!! WARNING !!!!
|
|
#
|
|
# This code is experimental, and SHOULD NOT be used in a
|
|
# production system. It is intended for validation and
|
|
# experimentation ONLY.
|
|
#
|
|
# In order for this to work, you will need to run configure:
|
|
#
|
|
# $ ./configure --with-dhcp
|
|
# $ make
|
|
# $ vi share/dictionary
|
|
#
|
|
# ## Un-comment the line containing $INCLUDE dictionary.dhcp
|
|
# ## Then, save the file.
|
|
#
|
|
# $ make install
|
|
#
|
|
# DHCP is NOT enabled by default.
|
|
#
|
|
# The goal of this effort is to get the code in front of
|
|
# people who are interested in another DHCP server.
|
|
# We NEED FEEDBACK, patches, bug reports, etc. Especially patches!
|
|
#
|
|
# Please contribute, or this work will be nothing more than
|
|
# a curiosity.
|
|
#
|
|
#
|
|
# Q: What does it do?
|
|
# A: It allows the server to receive DHCP packets, and to
|
|
# respond with static, pre-configured DHCP responses.
|
|
#
|
|
# Q: Does it do static/dynamic IP assignment?
|
|
# A: No. Or, maybe. Try it and see.
|
|
#
|
|
# Q: Does it read ISC configuration or lease files?
|
|
# A: No. Please submit patches.
|
|
#
|
|
# Q: Does it have DHCP feature X?
|
|
# A: No. Please submit patches.
|
|
#
|
|
# Q: Does it support option 82?
|
|
# A: Yes.
|
|
#
|
|
# Q: Does it support other options?
|
|
# A: Maybe. See dictionary.dhcp. Please submit patches.
|
|
#
|
|
# Q: It doesn't seem to do much of anything!
|
|
# A: Exactly.
|
|
#
|
|
# $Id: 33da1f10a67dd38b889300bc998737a268ef0948 $
|
|
#
|
|
######################################################################
|
|
|
|
#
|
|
# The DHCP functionality goes into a virtual server.
|
|
#
|
|
server dhcp {
|
|
|
|
# Define a DHCP socket.
|
|
#
|
|
# The default port below is 6700, so you don't break your network.
|
|
# If you want it to do real DHCP, change this to 67, and good luck!
|
|
#
|
|
# You can also bind the DHCP socket to an interface.
|
|
# See below, and raddb/radiusd.conf for examples.
|
|
#
|
|
# This lets you run *one* DHCP server instance and have it listen on
|
|
# multiple interfaces, each with a separate policy.
|
|
#
|
|
# If you have multiple interfaces, it is a good idea to bind the
|
|
# listen section to an interface. You will also need one listen
|
|
# section per interface.
|
|
#
|
|
# FreeBSD does *not* support binding sockets to interfaces. Therefore,
|
|
# if you have multiple interfaces, broadcasts may go out of the wrong
|
|
# one, or even all interfaces. The solution is to use the "setfib" command.
|
|
# If you have a network "10.10.0/24" on LAN1, you will need to do:
|
|
#
|
|
# Pick any IP on the 10.10.0/24 network
|
|
# $ setfib 1 route add default 10.10.0.1
|
|
#
|
|
# Edit /etc/rc.local, and add a line:
|
|
# setfib 1 /path/to/radiusd
|
|
#
|
|
# The kern must be built with the following options:
|
|
# options ROUTETABLES=2
|
|
# or any value larger than 2.
|
|
#
|
|
# The other only solution is to update FreeRADIUS to use BPF sockets.
|
|
#
|
|
|
|
# So that we only specify these values once, and then
|
|
# use them in all of the listen sections.
|
|
port = 6700
|
|
ipaddr = 127.0.0.1
|
|
interface = lo0
|
|
|
|
# When the machine is not Linux, or has only one network
|
|
# interface, use the following listener. It receives
|
|
# broadcast *and* unicast packets.
|
|
listen {
|
|
type = dhcp
|
|
|
|
ipaddr = *
|
|
port = ${..port}
|
|
interface = ${..interface}
|
|
|
|
# The DHCP server defaults to allowing broadcast packets.
|
|
# Set this to "no" only when the server receives *all* packets
|
|
# from a relay agent. i.e. when *no* clients are on the same
|
|
# LAN as the DHCP server.
|
|
#
|
|
# It's set to "no" here for testing.
|
|
broadcast = no
|
|
}
|
|
|
|
# When the machine is Linux and has multiple network interfaces, use
|
|
# the following two listeners instead of the one above.
|
|
|
|
# Listen for broadcasts on a specific interface.
|
|
listen {
|
|
type = dhcp
|
|
ipaddr = 255.255.255.255
|
|
port = ${..port}
|
|
interface = ${..interface}
|
|
|
|
#
|
|
# The source IP for unicast packets is chosen from the first
|
|
# one of the following items which returns a valid IP
|
|
# address:
|
|
#
|
|
# src_ipaddr
|
|
# ipaddr
|
|
# reply:DHCP-Server-IP-Address
|
|
# reply:DHCP-DHCP-Server-Identifier
|
|
#
|
|
# For now, use the parent's "ipaddr", not the one
|
|
# in this listen section
|
|
#
|
|
src_ipaddr = ${..ipaddr}
|
|
}
|
|
|
|
# Listen for unicasts on an IP, but not bound to any interface.
|
|
# This allows Linux systems to receive packets on interface X
|
|
# when the IP is associated with interface Y.
|
|
#
|
|
# Then, define which interface the packets go out of, via
|
|
# "src_interface". This means that the outbound packets
|
|
# get sent via the correct interface.
|
|
listen {
|
|
type = dhcp
|
|
ipaddr = ${..ipaddr}
|
|
port = ${..port}
|
|
|
|
#
|
|
# When sending unicast responses, this interface is
|
|
# used as the source interface. If unset, the value
|
|
# is taken from the "interface" field in this
|
|
# section.
|
|
#
|
|
# This interface is also used when adding ARP entries.
|
|
# FreeRADIUS doesn't open "raw" network sockets to send
|
|
# unicast DHCP responses on the local network. Instead,
|
|
# it updates the ARP table for this interface with the
|
|
# MAX and IP of the DHCP client. The server can then
|
|
# send a normal UDP unicast socket.
|
|
#
|
|
# NOTE: The server MUST be running as "root" in order
|
|
# to update the ARP table. Or, it must have the
|
|
# apropriate capabilities added to it after it starts up.
|
|
#
|
|
src_interface = ${..interface}
|
|
}
|
|
|
|
# Packets received on the socket will be processed through one
|
|
# of the following sections, named after the DHCP packet type.
|
|
# See dictionary.dhcp for the packet types.
|
|
dhcp DHCP-Discover {
|
|
update reply {
|
|
DHCP-Message-Type = DHCP-Offer
|
|
}
|
|
|
|
# The contents here are invented. Change them!
|
|
update reply {
|
|
DHCP-Domain-Name-Server = 127.0.0.1
|
|
DHCP-Domain-Name-Server = 127.0.0.2
|
|
DHCP-Subnet-Mask = 255.255.255.0
|
|
DHCP-Router-Address = 192.168.1.1
|
|
DHCP-IP-Address-Lease-Time = 86400
|
|
DHCP-DHCP-Server-Identifier = 192.168.1.1
|
|
}
|
|
|
|
# Do a simple mapping of MAC to assigned IP.
|
|
#
|
|
# See below for the definition of the "mac2ip"
|
|
# module.
|
|
#
|
|
#mac2ip
|
|
|
|
# If the MAC wasn't found in that list, do something else.
|
|
# You could call a Perl, Python, or Java script here.
|
|
|
|
#if (notfound) {
|
|
# ...
|
|
#}
|
|
|
|
# Or, allocate IPs from the DHCP pool in SQL.
|
|
# dhcp_sqlippool
|
|
|
|
ok
|
|
}
|
|
|
|
dhcp DHCP-Request {
|
|
update reply {
|
|
DHCP-Message-Type = DHCP-Ack
|
|
}
|
|
|
|
# The contents here are invented. Change them!
|
|
update reply {
|
|
DHCP-Domain-Name-Server = 127.0.0.1
|
|
DHCP-Domain-Name-Server = 127.0.0.2
|
|
DHCP-Subnet-Mask = 255.255.255.0
|
|
DHCP-Router-Address = 192.168.1.1
|
|
DHCP-IP-Address-Lease-Time = 86400
|
|
DHCP-DHCP-Server-Identifier = 192.168.1.1
|
|
}
|
|
|
|
# Do a simple mapping of MAC to assigned IP.
|
|
#
|
|
# See below for the definition of the "mac2ip"
|
|
# module.
|
|
#
|
|
#mac2ip
|
|
|
|
# If the MAC wasn't found in that list, do something else.
|
|
# You could call a Perl, Python, or Java script here.
|
|
|
|
#if (notfound) {
|
|
# ...
|
|
#}
|
|
|
|
# Or, allocate IPs from the DHCP pool in SQL.
|
|
# dhcp_sqlippool
|
|
|
|
ok
|
|
}
|
|
|
|
# If there's no named section for the packet type, then the packet
|
|
# is processed through this section.
|
|
dhcp {
|
|
# send a DHCP NAK.
|
|
reject
|
|
}
|
|
|
|
|
|
}
|
|
|
|
######################################################################
|
|
#
|
|
# This next section is a sample configuration for the "passwd"
|
|
# module, that reads flat-text files. It should go into
|
|
# radiusd.conf, in the "modules" section.
|
|
#
|
|
# The file is in the format <mac>,<ip>
|
|
#
|
|
# 00:01:02:03:04:05,192.168.1.100
|
|
# 01:01:02:03:04:05,192.168.1.101
|
|
# 02:01:02:03:04:05,192.168.1.102
|
|
#
|
|
# This lets you perform simple static IP assignment.
|
|
#
|
|
######################################################################
|
|
|
|
#passwd mac2ip {
|
|
# filename = ${confdir}/mac2ip
|
|
# format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address"
|
|
# delimiter = ","
|
|
#}
|