This chapter describes implementation specific details of MPD.
All authentication methods are supported (PAP, CHAP, MS-CHAPv1, MS-CHAPv2, EAP). Password changing is currently not supported.
Mpd automatically uses attributes like MTU, Idle-Timeout, IP-Address, etc. if they are transmitted by the RADIUS server.
Note: Its possible to use RADIUS-Accounting without RADIUS-Authentication.
The following attributes are set when doing accounting requests:
RAD_FRAMED_IP_ADDRESS
RAD_ACCT_STATUS_TYPE
RAD_ACCT_SESSION_ID
RAD_ACCT_MULTI_SESSION_ID
RAD_USER_NAME
RAD_ACCT_LINK_COUNT
RAD_ACCT_AUTHENTIC
RAD_ACCT_TERMINATE_CAUSE
RAD_ACCT_INPUT_OCTETS
RAD_ACCT_INPUT_PACKETS
RAD_ACCT_OUTPUT_OCTETS
RAD_ACCT_OUTPUT_PACKETS
RAD_ACCT_INPUT_GIGAWORDS
RAD_ACCT_OUTPUT_GIGAWORDS
RAD_ACCT_SESSION_TIME
Mpd allows RADIUS server to terminate user session by setting vendor specific mpd-drop-user attribute to nonzero value in accounting start/update reply packet.
Mpd can use the Access Control Lists (ACLs) taken from the RADIUS server. This ACLs may include ipfw rules, pipes, queues and tables and also mpd internal traffic filtering/shaping/limiting features. That two sets are redundant. ipfw proposed as standard and universal solution, while internal filter/shaper/limiter expected to work faster with big number of active links.
To use this feature you should add to your RADIUS server such dictionary:
#---------------------------------------------------------- # dictionary.mpd VENDOR mpd 12341 ATTRIBUTE mpd-rule 1 string mpd ATTRIBUTE mpd-pipe 2 string mpd ATTRIBUTE mpd-queue 3 string mpd ATTRIBUTE mpd-table 4 string mpd ATTRIBUTE mpd-table-static 5 string mpd ATTRIBUTE mpd-filter 6 string mpd ATTRIBUTE mpd-limit 7 string mpd ATTRIBUTE mpd-drop-user 154 integer mpd #----------------------------------------------------------
You can write in your RADIUS configuration something like:
mpd-table += "1=10.0.0.1", mpd-table += "1=10.0.0.15", mpd-pipe += "1=bw 10Kbyte/s", mpd-pipe += "5=bw 20Kbyte/s", mpd-rule += "1=pipe %p1 all from any to table(%t1) in", mpd-rule += "2=pipe %p5 all from table(%t1) to any out", mpd-rule += "100=allow all from any to any",
When mpd receives these parameters it will call ipfw(8) to create firewall rules, pipes and queues with unique numbers starting from 10000 (configurable via 'set global start...'). To the end of each rule will be added "via ngX" to make the rule apply only to that client's networking interface.
As a result of this example we would get these commands executed:
ipfw table 32 add 10.0.0.1 ipfw table 32 add 10.0.0.15 ipfw pipe 10000 config bw 10Kbyte/s ipfw pipe 10001 config bw 20Kbyte/s ipfw add 10000 pipe 10000 all from any to table(32) in via ng0 ipfw add 10001 pipe 10001 all from table(32) to any out via ng0 ipfw add 10002 allow all from any to any via ng0
When the link goes down, all created rules will be removed.
You can write in your RADIUS configuration something like:
mpd-filter += "1#1=nomatch src net 10.0.0.0/24", mpd-filter += "1#2=match src net 10.0.0.0/10", mpd-filter += "2#1=match dst net 10.0.0.0/16", mpd-filter += "2#2=match dst net 11.0.0.0/8", mpd-limit += "in#1=flt1 pass", mpd-limit += "in#2=flt2 shape 64000 4000 pass", mpd-limit += "in#3=all deny", mpd-limit += "out#1=flt2 pass", mpd-limit += "out#2=all rate-limit 1024000 150000 300000", mpd-limit += "out#3=all pass",
As result, one ng_bpf node will be created to implement traffic filters and several (two for this example) ng_car nodes for traffic shaping and rate-limiting.
mpd-filter is a packet filter declaration for using in mpd-limit. mpd-filter consists of two main parts: match/nomatch verdict and the condition. tcpdump (libpcap) expression syntax used for conditions.
mpd-filter: match|nomatch {condition}
mpd-limit is an action which should be done for packet. It consists of two main parts: filter and action.
mpd-limit: {filter} {action}
Filter can be or "all" (any packet) or "fltX" (packets matching to specified mpd-filter).
filter: any|fltX
Action can be: "pass" (stop processing and pass packet), "deny" (stop processing and drop packet), "rate-limit" (do Cisco-like rate-limit), "shape" (do simple RED aware traffic shaping).
Actions "rate-limit" and "shape" can have optional "pass" suffix to stop processing after doing this action.
action: pass | deny | rate-limit {rate(bits/s)} [{normal burst(bytes)} [{extended burst(bytes)}]] [pass] | shape {rate(bits/s)} [{burst(bytes)}] [pass]