README
¶
wilson
A Go (golang) dot1x server that runs locally on network switches as a secondary authentication server. When a switch becomes stranded from its primary dot1x server, wilson will authenticate endpoints by OUI using a flexible policy. Wilson was developed to provide supplemental policy-map type control support for an Arista EOS campus healthcare environment with colorless ports and a high up-time requirement.
TODO
This is effectively a prototype. While it servers the intended purpose, it needs tests and perhaps some refactoring. The goal of wilson is to be easily readable and maintainable.
Installation & Compilation
go get -u github.com/autoalan/wilson
Wilson will run once compiled without modification on most platforms. Simply clone this repository and compile wilson.go in the apps folder. For Arista EOS switches, use the 386 architecture.
# GOARCH=386 go build app/wilson.go
Usage
When executed for the first time, wilson expects to load its configuration from URL. Subsequent executions will use a defined configuration file (.wilson by default) automatically created in the directory containing the directory if the the server is unreachable or if the URL flag is omitted.
./wilson -url https://my-lb-site.internal.org/wilson.json
For implementations on Arista EOS, consider using an event-handler or even perhaps rc.eos.
Wilson expects the configuration to conform to a known JSON schema. Below is an example of a configuration file.
{
"configFile": ".wilson",
"configRefresh": 5,
"configURL": "https://my-lb-site.internal.org/wilson.json",
"serverBinding": "127.0.0.1:1812",
"serverSecret": "127001",
"policies": [{
"comment": "Issue an access-accept for trusted Roche analyzers",
"clientOui": "B8:78:79",
"clientVlan": 5,
"radiusCode": 2
},
{
"comment": "Issue an access-reject for unauthorized TP-Link endpoints",
"clientOui": "d8-07-b6",
"clientVlan": 0,
"radiusCode": 3
},
{
"comment": "Ignore all other requestst; the default policy is the last policy",
"clientOui": "0000.00",
"clientVlanvlan": 0,
"radiusCode": 0
}
]
}
| Parameter | Description |
|---|---|
| configFile | This is the path to the configuration that will be saved locally if the the server hosting the URL config is unavailable. |
| configRefresh | The interval in seconds to poll the server for configuration updates. |
| configURL | The URL to the initial configuration file. |
| serverBinding | The server binding used for requests. Typically this will be localhost for obvious reasons. |
| serverSecret | The RADIUS secret to authenticate the NAS client. |
| comment | Ignored by wilson. This is for humans. |
| clientOui | A 24-bit hexadecimal string representing the OUI of a MAC address. Delimiters (":", "-", ".") are ignored. |
| clientVlan | The VLAN to be assigned to the client on access-accept. |
| radiusCode | Standard RADIUS codes supported by the underlying radius library. A typical deployment would leverage 2 (Accept), 3 (Reject) and 0 (Ignore or discard the request). |
License
MPL 2.0
Author
Alan Haynes (alan@nre.dev).
Huge thanks to Tim Cooper for the superb radius implementation.
Documentation
¶
Index ¶
Constants ¶
const ( ErrConfigNotFound = "wilson: Error: The configuration could not be downloaded or read locally from disk." ErrConfigNotValid = "wilson: Error: The configuration failed." ErrConfigDecodeFailed = "wilson: Error: The configuration could not be decoded from JSON." ErrorStartup = "wilson: Error: Wilson is adrift: " HelpURLFlag = "The URL to a JSON configuration" NoticeStarted = "wilson: Notice: Wilson is listening to you" NoticeConfigUpdated = "wilson: Notice: The configuration was refreshed as requested" WarnConfigWriteFailed = "wilson: Warning: Failed to write the configuration to disk." WarnPolicyBadMAC = "wilson: Warning: Failed to extract a valid OUI from address " WarnPolicyDiscardRequest = "wilson: Warning: Discarding request for invalid OUI " )
const Schema string = `` /* 1765-byte string literal not displayed */
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Configuration ¶
type Configuration struct {
ConfigFile string `json:"configFile"`
ConfigRefresh float64 `json:"configRefresh"`
ConfigUrl string `json:"configUrl"`
ServerBinding string `json:"serverBinding"`
ServerSecret string `json:"serverSecret"`
Policies []Pol `json:"policies"`
}
func Config ¶
func Config(url string) Configuration
A public function to perform most of the lifting
func RefreshConfig ¶
func RefreshConfig(seconds float64, url string) Configuration
Refresh the configuration on a given interval using a go routine
Source Files
Directories