I mentioned in a previous post about my desktop ISP project I was using the accel-ppp access concentrator. This provides the main components for allowing my “users” to connect to my network, it handles all the authentication and setting up of PPPoE connections.
While playing with it I wanted to look at settings different DNS servers for different users. For IPv4 this was already built in, you could put entries in the LDAP that get passed on via the Radius lookup when a user connects. But with my messing about with IPv6 only networks I also wanted to set custom IPv6 DNS servers on a per user basis.
You can set a global set of DNS servers in the config file
...
[ipv6-dns]
dns=fd12:3456:789a::1
dns=fd12:3456:789a::2
...The Radius spec has an entry for holding IPv6 DNS server values (DNS-Server-IPv6-Address from RFC6911), but accel-ppp didn’t support using it. I mentioned it on the accel-ppp forum as a feature request and the developers seemed to think it would be a good idea, so I decided to have a go at implementing it.
First up adding the required bits to the LDAP for the test user, here I have one IPv4 DNS and one IPv6 DNS.
displayName: Ben Hardill
cn: Ben
sn: Hardill
mail: isp1@hardill.me.uk
uid: isp1
radiusReplyAttribute: MS-Primary-DNS-Server := "192.168.5.1"
radiusReplyAttribute: Reply-Message := "Hello World"
radiusReplyAttribute: Delegated-IPv6-Prefix := "fd12:3456:789a:2::/64"
radiusReplyAttribute: Framed-IPv6-Prefix := "fd12:3456:789a:0:192:168:5:2/128"
radiusReplyAttribute: DNS-Server-IPv6-Address := "fd12:3456:789a:ff64::1"
radiusFramedIPAddress: 192.168.5.2
radiusFramedIPNetmask: 255.255.255.0My first pass was a little naive in that it ended up changing the DNS servers for all subsequent users by overwriting the global settings. It also only supported providing 1 DNS server when the DHCPv6 and RA both support up to 3. So it was back to the drawing board.
First up is to generate a linked list containing the DNS server addresses from the Radius response.
...
case Framed_IPv6_Route:
rad_add_framed_ipv6_route(attr->val.string, rpd);
break;
case DNS_Server_IPv6_Address:
a = _malloc(sizeof(*a));
memset(a, 0, sizeof(*a));
a->addr = attr->val.ipv6addr;
list_add_tail(&a->entry, &rpd->ipv6_dns.addr_list);
break;
}
}
...This gets bound to the users session object so it can be retrieved later. In this case when responding to a DHCPv6 request.
...
if (!list_empty(&ses->ipv6_dns->addr_list)) {
list_for_each_entry(dns, &ses->ipv6_dns->addr_list, entry) {
j++;
}
if (j >= 3) {
j = 3;
}
opt1 = dhcpv6_option_alloc(reply, D6_OPTION_DNS_SERVERS, j * sizeof(addr));
addr_ptr = (struct in6_addr *)opt1->hdr->data;
list_for_each_entry(dns, &ses->ipv6_dns->addr_list, entry) {
if (k < j) {
memcpy(addr_ptr, &dns->addr, sizeof(addr));
k++;
addr_ptr++;
} else {
break;
}
}
...Now this is not as clean as I would like since we have to walk the list to know how many DNS servers there are in order to allocate the right size chunk of memory to hold the addresses and then walk it again to copy the addresses into the response. I might go back and add the list length to the session structure and update it when adding items to the list so we can avoid this step.
Testing
While working on these changes I wanted something a bit quicker than having to deploy the changes to my physical test rig (a collection of Raspberry Pi and switched hidden under my sofa). To help with this I spun up a VM with a copy of CORE. CORE comes from the NRL and allows you to build virtual networks and run code on nodes within the network.
This means I can start and stop the access coordinator really quickly and spin up as many clients as I want. I can also easily drop in L2TP clients (which use the same Radius and PPP infrastructure in accel-ppp) to check it works there as well. It also lets you attach tools like tcpdump and wireshark to capture packets at any point in the network which can be difficult with home grade switches (enterprise switches tend to have admin interfaces and the ability to nominate ports as taps that can see all traffic).
I have submitted a pull request against the project, so now fingers crossed it gets accepted.
