# -*- text -*-
######################################################################
#
#	This is a virtual server that handles DHCP.
#
#		!!!! WARNING !!!!
#
#	This code is experimental, and SHOULD NOT be used in a
#	production system.  It is intended for validation and
#	experimentation ONLY.
#
#	In order for this to work, you will need to:
#   * Compile freeradius with DHCP functionality (this PPA package 
#     already did that).
#   * Make sure freeradius-mysql package is installed.
#   * Edit radiusd.conf.
#     * Make sure "user = root". Needed for arp updates to work.
#     * Uncomment the line $INCLUDE sql.conf.
#   * Edit sql.conf, adjust as needed,
#   * Edit mods-available/dhcp_sqlippool, uncomment the line
#     $INCLUDE ${confdir}/sql/mysql/ippool-dhcp.conf.
#   * Create sqlippool table, if you haven't done so already.
#       * Import the schema (see sql/mysql/ipool.sql).
#       * Populate the records. At minimum each row must have
#         Framed-IP-Address and Pool-Name = 'DHCP-default' (or whatever
#         you set 'Pool-Name' to on policy.conf).
#       * If you want to use static IP allocation, create a row on  
#         radippol table with 'callingstationid' set to client's MAC 
#         address (e.g. '00:16:3E:02:15:6B') and expiry time far in the 
#         future (e.g. '3000-01-01 00:00:00').
#   * Create a symlink to ../sites-available/dhcp on 
#     sites/enabled.
#
#	The goal of this effort is to get the code in front of
#	people who are interested in another DHCP server.
#	We NEED FEEDBACK, patches, bug reports, etc.  Especially patches!
#
#	Please contribute, or this work will be nothing more than
#	a curiosity.
#
#
#	Q: What does it do?
#	A: It allows the server to receive DHCP packets, and to
#	   respond with static, pre-configured DHCP responses.
#
#	Q: Does it do static/dynamic IP assignment?
#	A: No.  Or, maybe.  Try it and see.
#
#	Q: Does it read ISC configuration or lease files?
#	A: No.  Please submit patches.
#
#	Q: Does it have DHCP feature X?
#	A: No.  Please submit patches.
#
#	Q: Does it support option 82?
#	A: Yes.
#
#	Q: Does it support other options?
#	A: Maybe.  See dictionary.dhcp.  Please submit patches.
#
#	Q: It doesn't seem to do much of anything!
#	A: Exactly.
#
#	$Id: 33da1f10a67dd38b889300bc998737a268ef0948 $
#
######################################################################

#
#  The DHCP functionality goes into a virtual server.
#
server dhcp {

#  Define a DHCP socket.
#
#  The default port below is 6700, so you don't break your network.
#  If you want it to do real DHCP, change this to 67, and good luck!
#
#  You can also bind the DHCP socket to an interface.
#  See below, and raddb/radiusd.conf for examples.
#
#  This lets you run *one* DHCP server instance and have it listen on
#  multiple interfaces, each with a separate policy.
#
#  If you have multiple interfaces, it is a good idea to bind the
#  listen section to an interface.  You will also need one listen
#  section per interface.
#
#  FreeBSD does *not* support binding sockets to interfaces.  Therefore,
#  if you have multiple interfaces, broadcasts may go out of the wrong
#  one, or even all interfaces.  The solution is to use the "setfib" command.
#  If you have a network "10.10.0/24" on LAN1, you will need to do:
#
#  Pick any IP on the 10.10.0/24 network
#	$ setfib 1 route add default 10.10.0.1
#
#  Edit /etc/rc.local, and add a line:
#	setfib 1 /path/to/radiusd
#
#  The kern must be built with the following options:
#	options    ROUTETABLES=2
#  or any value larger than 2.
#
# The other only solution is to update FreeRADIUS to use BPF sockets.
#

	#  So that we only specify these values once, and then
	#  use them in all of the listen sections.
	#  Use loopback interface and port=6700 for testing purposes
	port = 6700
	ipaddr = 127.0.0.1
	interface = lo0

	#  If you want to use this on a Linux server for production or on a
	#  virtual test environment, use these settings instead
	#port = 67
	#  Change this to your server's IP address
	#ipaddr = 172.16.101.2
	#interface = eth0

	#  When the machine is not Linux, or has only one network
	#  interface, use the following listener.  It receives
	#  broadcast *and* unicast packets.
	listen {
		type = dhcp

		ipaddr = *
		port = ${..port}
		interface = ${..interface}

		# The DHCP server defaults to allowing broadcast packets.
		# Set this to "no" only when the server receives *all* packets
		# from a relay agent.  i.e. when *no* clients are on the same
		# LAN as the DHCP server.
		#
		# It's set to "no" here for testing.
		broadcast = no
	}

	# When the machine is Linux and has multiple network interfaces, use
	# the following two listeners instead of the one above.

	#  Listen for broadcasts on a specific interface.
	#listen {
	#	type = dhcp
	#	ipaddr = 255.255.255.255
	#	port = ${..port}
	#	interface = ${..interface}

		#
		#  The source IP for unicast packets is chosen from the first
		#  one of the following items which returns a valid IP
		#  address:
		#
		#	src_ipaddr
		#	ipaddr
		#	reply:DHCP-Server-IP-Address
		#	reply:DHCP-DHCP-Server-Identifier
		#
		#  For now, use the parent's "ipaddr", not the one
		#  in this listen section
		#
    #            src_ipaddr = ${..ipaddr}
	#}

	#  Listen for unicasts on an IP, but not bound to any interface.
	#  This allows Linux systems to receive packets on interface X
	#  when the IP is associated with interface Y.
	#
	#  Then, define which interface the packets go out of, via
	#  "src_interface".  This means that the outbound packets
	#  get sent via the correct interface.
	#listen {
	#	type = dhcp
	#	ipaddr = ${..ipaddr}
	#	port = ${..port}

		#
		#  When sending unicast responses, this interface is
		#  used as the source interface.  If unset, the value
		#  is taken from the "interface" field in this
		#  section.
		#
		#  This interface is also used when adding ARP entries.
		#  FreeRADIUS doesn't open "raw" network sockets to send
		#  unicast DHCP responses on the local network.  Instead,
		#  it updates the ARP table for this interface with the
		#  MAX and IP of the DHCP client.  The server can then
		#  send a normal UDP unicast socket.
		#
		#  NOTE: The server MUST be running as "root" in order
		#  to update the ARP table.  Or, it must have the
		#  apropriate capabilities added to it after it starts up.
		#
	#	src_interface = ${..interface}
	#}

#  Packets received on the socket will be processed through one
#  of the following sections, named after the DHCP packet type.
#  See dictionary.dhcp for the packet types.
dhcp DHCP-Discover {
	update reply {
	       DHCP-Message-Type = DHCP-Offer
	}

	#  The contents here are invented.  Change them!
	update reply {
		DHCP-Domain-Name-Server = 8.8.8.8
		DHCP-Domain-Name-Server += 8.8.4.4
		DHCP-Subnet-Mask = 255.255.255.0
		DHCP-Router-Address = 172.16.101.1
		DHCP-IP-Address-Lease-Time = 7200
		DHCP-DHCP-Server-Identifier = 172.16.101.2
	}

	#  Do a simple mapping of MAC to assigned IP.
	#
	#  See below for the definition of the "mac2ip"
	#  module.
	#
	#mac2ip

	#  If the MAC wasn't found in that list, do something else.
	#  You could call a Perl, Python, or Java script here.

	#if (notfound) {
	# ...
	#}

	#  Or, allocate IPs from the DHCP pool in SQL.
	dhcp_sqlippool.postauth

	ok
}

dhcp DHCP-Request {
	update reply {
	       DHCP-Message-Type = DHCP-Ack
	}

	#  The contents here are invented.  Change them!
	update reply {
		DHCP-Domain-Name-Server = 8.8.8.8
		DHCP-Domain-Name-Server += 8.8.4.4
		DHCP-Subnet-Mask = 255.255.255.0
		DHCP-Router-Address = 172.16.101.1
		DHCP-IP-Address-Lease-Time = 7200
		DHCP-DHCP-Server-Identifier = 172.16.101.2
	}

	#  Do a simple mapping of MAC to assigned IP.
	#
	#  See below for the definition of the "mac2ip"
	#  module.
	#
	#mac2ip

	#  If the MAC wasn't found in that list, do something else.
	#  You could call a Perl, Python, or Java script here.

	#if (notfound) {
	# ...
	#}

	#  Or, allocate IPs from the DHCP pool in SQL.
	dhcp_sqlippool.postauth

	ok
}

#  If there's no named section for the packet type, then the packet
#  is processed through this section.
dhcp {
	# send a DHCP NAK.
	reject
}


}

######################################################################
#
#  This next section is a sample configuration for the "passwd"
#  module, that reads flat-text files.  It should go into
#  radiusd.conf, in the "modules" section.
#
#  The file is in the format <mac>,<ip>
#
#	00:01:02:03:04:05,192.168.1.100
#	01:01:02:03:04:05,192.168.1.101
#	02:01:02:03:04:05,192.168.1.102
#
#  This lets you perform simple static IP assignment.
#
######################################################################

#passwd mac2ip {
#	filename = ${confdir}/mac2ip
#	format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address"
#	delimiter = ","
#}
