YFi Hotspot Manager Wiki

Brought to you by: dvdwalt

YfiTechPrimeNormal

Labels:

Authors: Anonymous

WARNING: THIS IS UNDER ACTIVE DEVELOPMENT!!!!

Differentiation between prime time and normal hours

Terms used

To clarify the terms used on this page

Prime time: This will usually be office hours when everyone is at work and Internet usage is high.
Normal hours: The opposite of prime time. When Internet usage is lower.

Requirement

One of our users (Muffy) had a request for the following:

User is only allowed Internet access for two hours during prime time.
User is allowed unlimited Internet access time during normal hours.

This then lead to additional requirements

Give a user limited bandwidth (speed) during prime time.
Give a user better bandwidth (speed) during normal hours.
Limit data usage during prime time.
Limit date usage during normal hours

Solution

Supported NAS devices

Initial support will only be for CoovaChilli.
There are plans to also include Mikrotik after the Beta-4 release.

Create Special FreeRADIUS dictionary attributes

We will start off by adding the following attributes to the /usr/local/share/freeradius/dictionary.chillispot file.

#YFi Prime time - Normal Time differentiation
ATTRIBUTE       Yfi-Prime-Start                         140     string
ATTRIBUTE       Yfi-Prime-End                           141     string
ATTRIBUTE       Yfi-Prime-Total-Octets                  142     integer
ATTRIBUTE       Yfi-Prime-Session                       143     integer
ATTRIBUTE       Yfi-Normal-Total-Octets                 144     integer
ATTRIBUTE       Yfi-Normal-Session                      145     integer
ATTRIBUTE       Yfi-Prime-Bandwidth-Max-Up              146     integer
ATTRIBUTE       Yfi-Normal-Bandwidth-Max-Down           148     integer
ATTRIBUTE       Yfi-Prime-Bandwidth-Max-Down            149     integer
ATTRIBUTE       Yfi-Normal-Bandwidth-Max-Up             150     integer

Taking the above attributes in account we can now specify per user or per profile the following:

Description
Attribute
Check/Reply
Sample Value

Start of prime time
Yfi-Prime-Start
Check
08:00

End of Prime time
Yfi-Prime-End
Check
17:00

Data usage - prime time
Yfi-Prime-Total-Octets
Check
10485760 (10Meg)

Time usage - prime time
Yfi-Prime-Session
Check
3600 (1Hour)

Data usage - normal time
Yfi-Normal-Total-Octets
Check
10485760 (10Meg)

Time usage - normal time
Yfi-Normal-Session
Check
3600 (1Hour)

Bandwidth - prime time
Yfi-Prime-Bandwidth-Max-Up and Yfi-Prime-Bandwidth-Max-Down
Check
131072 (128Kb/s)

Bandwidth - normal time
Yfi-Normal-Bandwidth-Max-Up and Yfi-Normal-Bandwidth-Max-Down
Check
131072 (128Kb/s)

Add a times SQL table

We add a table to the database which will keep track when a session is in prime time or normal time.
It will be used to measure against the check values - be it time or data based during prime time and normal time.

The table will be as follows

DROP TABLE IF EXISTS `times`;
SET @saved_cs_client     = @@character_set_client;
SET character_set_client = utf8;
CREATE TABLE `times` (
  `id` bigint(21) NOT NULL auto_increment,
  `acctsessionid` varchar(64) NOT NULL default '',
  `username` varchar(64) NOT NULL default '',
  `time` bigint(20) default NULL,
  `data` bigint(20) default NULL,
  `type` enum('Prime','Normal') default 'Normal',
  `created` datetime NOT NULL,
  `modified` datetime NOT NULL,
  PRIMARY KEY  (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=0 DEFAULT CHARSET=latin1;
SET character_set_client = @saved_cs_client;

Modify rlm_perl

YFi Hotspot Manager changes FreeRADIUS to use custom Perl modules when doing authentication and authorization of users.
It also uses Perl in conjunction with the sql module for accounting.
This enable us to do checks upon each accounting request received from a NAS device.

With the above in mind we can do the following:

Create an additional Prime.pm Perl module to be used by rlm_perl.
If a user has Yfi-Prime-Start and Yfi-Prime-End check attributes attached to their name Prime.pm's code will handle the authentication and authorization requests.
This will then verify if there are limits specified on the amount of time and/or data that can be used during a period in the day.
If these limits are crossed, the user will be disconnected and subsequent authentication requests will fail until the period passed.
(Still to finish) If there are adjustments to bandwidth to be during the start of a period, it will send the request to the NAS device to do adjustments.

Activate Prime.pm

To activate the above functionality you can use the /var/www/c2/yfi_cake/setup/radius/raddb.tar.gz tar file included in SVN 261 and higher.

This functionality is disabled by default, to activate it, uncomment the following in _/usr/local/etc/raddb/rlm: _

Include the authentication request.

#---- Comment out for Prime time / Normal time function ---
my $prime_return = prime_auth($username);
if ($prime_return != 1){
   $RAD_REPLY{'Reply-Message'} = "$prime_return";
   return 0;
}
#----------------------------------------------------------

Include the accounting request.

#---- Comment out for Prime time / Normal time function ---
prime_accounting(\%RAD_REQUEST);
#----------------------------------------------------------

Restart FreeRADIUS
```
sudo /etc/init.d/radiusd restart
```

Prime.pm

This section will discuss detail around the workings of Prime.pm.

Authentication Requests

When an authentication request comes in to FreeRADIUS, and there's Yfi-Prime-Start and Yfi-Prime-End check attributes defined for the user we handle the request.
Code determines if we are now in prime time or normal hours.
Should a defined quota for a defined period (be it prime time or normal hours) be reached, the authentication request will be rejected with accompanying feedback message.

Accounting Requests

This is the tricky part - Accounting request will arrive between transition times.
We have to determine whether a transition happened between prime-time and normal time.
We than have to start new calculations based on whether we are in prime time or normal time.
We also need to feedback info (bandwidth control) info to the NAS device if there is a difference in bandwidth specified during the transition.
Should a limit (for data or time ) imposed be reached (based on latest calculations from accounting request) the user needs to be disconnected from the NAS device.

Conclusion

(Still outstanding): Bandwidth limitations will be imposed by contacting the NAS device directly (via SSH and Key pairs)and instructing a new limitation for a period of time.
(Still outstanding): Change in bandwidth - if required - will be requested by the FreeRADIUS server to the NAS device.
When data and/or time restrictions are reached, a disconnect request will be send to the NAS device to terminate a user's connection.

Test It Out

NOTE: This is a very quick draft

The following can be used as a test to determine if the differentiation between prime time and normal time happens as intended.

Take a test user and add the following Personal Attributes to the user.

Attribute
Check/Reply
Typical value

Yfi-Prime-Start
Check
08:00

Yfi-Prime-End
Check
08:30

Yfi-Prime-Total-Octets
Check
10485760

Yfi-Normal-Total-Octets
Check
20485760

Then:

Ensure the module is activates in the authentication and accounting sections.
Ensure that you kick the user off using the boot icon in the activity viewer tab.
Start FreeRADIUS in bebug mode just after 08:00 and download something bigger than 10Meg.
Very soon after the 10Meg is downloaded (on the next accounting request coming in from the NAS) FreeRADIUS should tell the NAS to kick the user off.
Try and log in again - you should not be able to log in up until 08:30 - Thats when prime time is over.
Then you have from 08:30 until 00:00 the next day to consume the 20485760 bytes.
When the clock strikes 00:00, then new normal time begins, and you once again have 20485760 bytes to spend (as long as its not between 08:00 and 08:30).

Wiki: Home