/etc/freeradius/3.0/policy.d/canonicalization is in freeradius-config 3.0.16+dfsg-1ubuntu3.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 | #
# Split User-Name in NAI format (RFC 4282) into components
#
# This policy writes the Username and Domain portions of the
# NAI into the Stripped-User-Name and Stripped-User-Domain
# attributes.
#
# The regular expression to do this is not strictly compliant
# with the standard, but it is not possible to write a
# compliant regexp without perl style regular expressions (or
# at least not a legible one).
#
nai_regexp = '^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$'
split_username_nai {
if (&User-Name && (&User-Name =~ /${policy.nai_regexp}/)) {
update request {
&Stripped-User-Name := "%{1}"
}
# Only add the Stripped-User-Domain attribute if
# we have a domain. This means presence checks
# for Stripped-User-Domain work.
if ("%{3}" != '') {
update request {
&Stripped-User-Domain = "%{3}"
}
}
# If any of the expansions result in a null
# string, the update section may return
# something other than updated...
updated
}
else {
noop
}
}
#
# If called in post-proxy we modify the proxy-reply message
#
split_username_nai.post-proxy {
if (&proxy-reply:User-Name && (&proxy-reply:User-Name =~ /${policy.nai_regexp}/)) {
update proxy-reply {
&Stripped-User-Name := "%{1}"
}
# Only add the Stripped-User-Domain attribute if
# we have a domain. This means presence checks
# for Stripped-User-Domain work.
if ("%{3}" != '') {
update proxy-reply {
&Stripped-User-Domain = "%{3}"
}
}
updated
}
else {
noop
}
}
#
# Normalize the MAC Addresses in the Calling/Called-Station-Id
#
mac-addr-regexp = '([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})'
#
# Add "rewrite_called_station_id" in the "authorize" and
# "preacct" sections.
#
# Makes Called-Station-ID conform to what RFC3580 says should
# be provided by 802.1X authenticators.
#
rewrite_called_station_id {
if (&Called-Station-Id && (&Called-Station-Id =~ /^${policy.mac-addr-regexp}([^0-9a-f](.+))?$/i)) {
update request {
&Called-Station-Id := "%{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}"
}
# SSID component?
if ("%{8}") {
update request {
&Called-Station-SSID := "%{8}"
}
}
updated
}
else {
noop
}
}
#
# Add "rewrite_calling_station_id" in the "authorize" and
# "preacct" sections.
#
# Makes Calling-Station-ID conform to what RFC3580 says should
# be provided by 802.1X authenticators.
#
rewrite_calling_station_id {
if (&Calling-Station-Id && (&Calling-Station-Id =~ /^${policy.mac-addr-regexp}$/i)) {
update request {
&Calling-Station-Id := "%{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}"
}
updated
}
else {
noop
}
}
|