+ {{ lang._('Configuration changed, apply to activate.') }}
+
+
+
+
+
+
+
+{{ partial("layout_partials/base_dialog",['fields':formDialogAC,'id':'DialogAC','label':lang._('Edit access concentrator')]) }}
+{{ partial("layout_partials/base_dialog",['fields':formDialogPool,'id':'DialogPool','label':lang._('Edit address pool')]) }}
+{{ partial("layout_partials/base_dialog",['fields':formDialogUser,'id':'DialogUser','label':lang._('Edit local user')]) }}
+{{ partial("layout_partials/base_dialog",['fields':formDialogRadius,'id':'DialogRadius','label':lang._('Edit RADIUS server')]) }}
+
+
diff --git a/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/coa_daemon.py b/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/coa_daemon.py
new file mode 100755
index 0000000000..16ddc2c2b0
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/coa_daemon.py
@@ -0,0 +1,264 @@
+#!/usr/local/bin/python3
+
+"""
+ Copyright (C) 2026 VEQNORA
+ All rights reserved.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+ THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+
+ RFC 5176 Disconnect-Message adapter for mpd5. mpd5 has no native CoA /
+ Disconnect listener, so this small daemon speaks the RADIUS Dynamic
+ Authorization protocol and translates a Disconnect-Request into an mpd5
+ control-console session close (re-using the same console client the GUI
+ uses). It answers Disconnect-ACK / Disconnect-NAK with the correct
+ response authenticator and honours a source allowlist and shared secret.
+
+ Sessions are matched (in RFC-preferred order) by Acct-Session-Id, then
+ User-Name, then Framed-IP-Address. CoA-Request (reauthorize) is answered
+ with CoA-NAK / Unsupported-Service because mpd5 cannot re-apply attributes
+ to a live session; only Disconnect is actioned.
+"""
+
+import hashlib
+import hmac
+import ipaddress
+import importlib.util
+import os
+import socket
+import struct
+import sys
+
+CONF = '/usr/local/etc/pppoe_server/coa.conf'
+
+_spec = importlib.util.spec_from_file_location(
+ 'pppoe_console', os.path.join(os.path.dirname(os.path.abspath(__file__)), 'pppoe_console.py'))
+pppoe_console = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(pppoe_console)
+
+# RADIUS Dynamic Authorization codes (RFC 5176 / RFC 3576)
+DISCONNECT_REQUEST = 40
+DISCONNECT_ACK = 41
+DISCONNECT_NAK = 42
+COA_REQUEST = 43
+COA_ACK = 44
+COA_NAK = 45
+
+ATTR_USER_NAME = 1
+ATTR_NAS_IP_ADDRESS = 4
+ATTR_FRAMED_IP_ADDRESS = 8
+ATTR_ACCT_SESSION_ID = 44
+ATTR_MESSAGE_AUTHENTICATOR = 80
+ATTR_ERROR_CAUSE = 101
+
+# Error-Cause values (RFC 5176 section 3.5)
+CAUSE_SESSION_NOT_FOUND = 503
+CAUSE_UNSUPPORTED_SERVICE = 405
+
+
+def read_conf(path=CONF):
+ cfg = {'port': 3799, 'secret': b'', 'allowed': []}
+ with open(path, 'r', encoding='ascii') as fh:
+ for line in fh:
+ line = line.strip()
+ if not line or line.startswith('#') or '=' not in line:
+ continue
+ key, val = line.split('=', 1)
+ key, val = key.strip(), val.strip()
+ if key == 'port':
+ cfg['port'] = int(val)
+ elif key == 'secret':
+ cfg['secret'] = val.encode()
+ elif key == 'allowed':
+ for item in val.split(','):
+ item = item.strip()
+ if item:
+ cfg['allowed'].append(ipaddress.ip_network(item, strict=False))
+ return cfg
+
+
+def parse_attributes(data):
+ """return list of (type, value_bytes) from a RADIUS attribute blob"""
+ attrs = []
+ i = 0
+ while i + 2 <= len(data):
+ atype = data[i]
+ alen = data[i + 1]
+ if alen < 2 or i + alen > len(data):
+ break
+ attrs.append((atype, data[i + 2:i + alen]))
+ i += alen
+ return attrs
+
+
+def verify_request(packet, secret):
+ """
+ validate the Request Authenticator of a Disconnect/CoA request
+ (RFC 5176 2.3): MD5(Code+ID+Length+RequestAuth(as received) is wrong;
+ it is MD5(Code+ID+Length+16 zero octets replaced by request auth? )).
+ Correct: the Request Authenticator = MD5(Code+ID+Length+Attributes+Secret)
+ computed with the Authenticator field itself zeroed.
+ """
+ if len(packet) < 20:
+ return False
+ code, ident, length = struct.unpack('!BBH', packet[:4])
+ authenticator = packet[4:20]
+ attrs = packet[20:length] if length <= len(packet) else packet[20:]
+ zeroed = packet[:4] + (b'\x00' * 16) + attrs
+ expected = hashlib.md5(zeroed + secret).digest()
+ if not hmac.compare_digest(expected, authenticator):
+ return False
+ # optional Message-Authenticator
+ for atype, val in parse_attributes(attrs):
+ if atype == ATTR_MESSAGE_AUTHENTICATOR:
+ probe = bytearray(packet[:length])
+ # zero the Message-Authenticator in place, then HMAC-MD5
+ idx = probe.find(bytes([ATTR_MESSAGE_AUTHENTICATOR, 18]))
+ if idx >= 0:
+ for j in range(idx + 2, idx + 18):
+ probe[j] = 0
+ mac = hmac.new(secret, bytes(probe), hashlib.md5).digest()
+ if not hmac.compare_digest(mac, val):
+ return False
+ return True
+
+
+def build_response(code, ident, request_authenticator, secret, error_cause=None):
+ attrs = b''
+ if error_cause is not None:
+ attrs += struct.pack('!BBI', ATTR_ERROR_CAUSE, 6, error_cause)
+ length = 20 + len(attrs)
+ header = struct.pack('!BBH', code, ident, length)
+ resp_auth = hashlib.md5(header + request_authenticator + attrs + secret).digest()
+ return header + resp_auth + attrs
+
+
+def find_session(sessions, wanted):
+ if wanted.get('session_id'):
+ for s in sessions:
+ if s['session_id'] == wanted['session_id']:
+ return s
+ if wanted.get('username'):
+ for s in sessions:
+ if s['username'] == wanted['username']:
+ return s
+ if wanted.get('address'):
+ for s in sessions:
+ if s['address'] == wanted['address']:
+ return s
+ return None
+
+
+def disconnect(session):
+ """close a session via the mpd console; return True on success"""
+ try:
+ host, port, user, pw = pppoe_console.read_auth()
+ client = pppoe_console.ConsoleClient(host, port, user, pw)
+ try:
+ client.run('session %s' % session['session_id'])
+ client.run('close')
+ finally:
+ client.close()
+ return True
+ except (OSError, ValueError, ConnectionError):
+ return False
+
+
+def handle(packet, addr, cfg, sock):
+ src = ipaddress.ip_address(addr[0])
+ if not any(src in net for net in cfg['allowed']):
+ return # silently drop unauthorised sources
+ if len(packet) < 20:
+ return
+ code, ident, length = struct.unpack('!BBH', packet[:4])
+ request_authenticator = packet[4:20]
+ if not verify_request(packet, cfg['secret']):
+ return # bad secret / authenticator -> drop
+
+ if code == COA_REQUEST:
+ # mpd5 cannot re-apply attributes to a live session
+ sock.sendto(build_response(COA_NAK, ident, request_authenticator,
+ cfg['secret'], CAUSE_UNSUPPORTED_SERVICE), addr)
+ return
+ if code != DISCONNECT_REQUEST:
+ return
+
+ wanted = {}
+ for atype, val in parse_attributes(packet[20:length]):
+ if atype == ATTR_ACCT_SESSION_ID:
+ sid = val.decode('ascii', 'ignore')
+ if pppoe_console.SESSION_RE.match(sid):
+ wanted['session_id'] = sid
+ elif atype == ATTR_USER_NAME:
+ name = val.decode('ascii', 'ignore')
+ if pppoe_console.USERNAME_RE.match(name):
+ wanted['username'] = name
+ elif atype == ATTR_FRAMED_IP_ADDRESS and len(val) == 4:
+ wanted['address'] = socket.inet_ntoa(val)
+
+ try:
+ host, port, user, pw = pppoe_console.read_auth()
+ client = pppoe_console.ConsoleClient(host, port, user, pw)
+ try:
+ sessions = pppoe_console.parse_sessions(client.run('show sessions'))
+ finally:
+ client.close()
+ except (OSError, ValueError, ConnectionError):
+ sock.sendto(build_response(DISCONNECT_NAK, ident, request_authenticator,
+ cfg['secret'], CAUSE_SESSION_NOT_FOUND), addr)
+ return
+
+ session = find_session(sessions, wanted)
+ if session is not None and disconnect(session):
+ sock.sendto(build_response(DISCONNECT_ACK, ident, request_authenticator,
+ cfg['secret']), addr)
+ else:
+ sock.sendto(build_response(DISCONNECT_NAK, ident, request_authenticator,
+ cfg['secret'], CAUSE_SESSION_NOT_FOUND), addr)
+
+
+def main():
+ try:
+ cfg = read_conf()
+ except (OSError, ValueError) as exc:
+ sys.stderr.write('coa: bad config: %s\n' % exc)
+ return 1
+ if not cfg['secret'] or not cfg['allowed']:
+ sys.stderr.write('coa: secret and at least one allowed client required\n')
+ return 1
+
+ sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+ sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+ sock.bind(('0.0.0.0', cfg['port']))
+ sys.stderr.write('coa: listening on udp/%d\n' % cfg['port'])
+ while True:
+ try:
+ packet, addr = sock.recvfrom(4096)
+ except OSError:
+ continue
+ try:
+ handle(packet, addr, cfg, sock)
+ except Exception as exc: # never let one packet kill the daemon
+ sys.stderr.write('coa: error handling packet from %s: %s\n' % (addr, exc))
+
+
+if __name__ == '__main__':
+ sys.exit(main())
diff --git a/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/diagnostics.py b/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/diagnostics.py
new file mode 100755
index 0000000000..27abf12e7c
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/diagnostics.py
@@ -0,0 +1,227 @@
+#!/usr/local/bin/python3
+
+"""
+ Copyright (C) 2026 VEQNORA
+ All rights reserved.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+ THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+
+ diagnostics helpers for the PPPoE server plugin. every output path
+ masks secrets: mpd.secret is never shown, RADIUS shared secrets and the
+ console credential are replaced before anything leaves this script.
+"""
+
+import argparse
+import importlib.util
+import json
+import os
+import re
+import subprocess
+import sys
+
+CONF_DIR = '/usr/local/etc/pppoe_server'
+MPD_CONF = os.path.join(CONF_DIR, 'mpd.conf')
+
+_spec = importlib.util.spec_from_file_location(
+ 'pppoe_console', os.path.join(os.path.dirname(os.path.abspath(__file__)), 'pppoe_console.py'))
+pppoe_console = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(pppoe_console)
+
+MASK_RULES = (
+ # set radius server [ports] -> mask the secret column
+ (re.compile(r'^(\s*set radius server\s+\S+\s+)\S+', re.M), r'\1********'),
+ # set user [priv] -> mask the password column
+ (re.compile(r'^(\s*set user\s+\S+\s+)\S+', re.M), r'\1********'),
+)
+
+
+def mask_config(text):
+ for pattern, replacement in MASK_RULES:
+ text = pattern.sub(replacement, text)
+ return text
+
+
+def run_cmd(cmd, timeout=15):
+ try:
+ proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, check=False)
+ return proc.returncode, proc.stdout.strip(), proc.stderr.strip()
+ except (OSError, subprocess.SubprocessError) as exc:
+ return 1, '', str(exc)
+
+
+def config_preview():
+ try:
+ with open(MPD_CONF, 'r', encoding='utf-8') as handle:
+ return {'status': 'ok', 'preview': mask_config(handle.read())}
+ except OSError as exc:
+ return {'status': 'failed', 'message': str(exc)}
+
+
+def netgraph_status():
+ code, out, err = run_cmd(['/usr/sbin/ngctl', 'list'])
+ if code != 0:
+ return {'status': 'failed', 'message': err or 'ngctl failed'}
+ nodes = [n for n in out.splitlines() if n.strip().startswith('Name:')]
+ pppoe_related = [n.strip() for n in nodes
+ if re.search(r'Type:\s*(pppoe|ppp|iface|ether)\b', n, re.I)]
+ return {'status': 'ok', 'nodes': len(nodes), 'listing': '\n'.join(pppoe_related)}
+
+
+def versions():
+ result = {'status': 'ok'}
+ code, out, _ = run_cmd(['/usr/sbin/pkg', 'query', '%v', 'mpd5'])
+ result['mpd5'] = out if code == 0 else 'not installed'
+ code, out, _ = run_cmd(['/usr/sbin/pkg', 'query', '%v', 'os-pppoe-server'])
+ result['plugin'] = out if code == 0 else 'development'
+ code, out, _ = run_cmd(['/usr/bin/uname', '-rs'])
+ result['os'] = out if code == 0 else ''
+ return result
+
+
+def validate():
+ problems = []
+ if not os.path.isfile(MPD_CONF):
+ problems.append('mpd.conf is missing - apply the configuration first')
+ else:
+ with open(MPD_CONF, 'r', encoding='utf-8') as handle:
+ conf = handle.read()
+ for keyword in ('startup:', 'pppoe_server:'):
+ if keyword not in conf:
+ problems.append('mpd.conf lacks the %s section' % keyword)
+ ifaces = set(re.findall(r'^\s*set pppoe iface\s+(\S+)', conf, re.M))
+ code, out, _ = run_cmd(['/sbin/ifconfig', '-l'])
+ present = set(out.split()) if code == 0 else set()
+ for iface in sorted(ifaces - present):
+ problems.append('interface %s not present on this system' % iface)
+ for name in ('mpd.secret', 'console.auth'):
+ path = os.path.join(CONF_DIR, name)
+ if os.path.isfile(path):
+ mode = os.stat(path).st_mode & 0o777
+ if mode & 0o077:
+ problems.append('%s permissions too open (%o)' % (name, mode))
+ status = 'ok' if not problems else 'failed'
+ return {'status': status, 'problems': problems}
+
+
+def support_bundle():
+ """masked, secret-free diagnostic snapshot"""
+ bundle = {'status': 'ok', 'sections': {}}
+ bundle['sections']['versions'] = versions()
+ bundle['sections']['validate'] = validate()
+ bundle['sections']['netgraph'] = netgraph_status()
+ bundle['sections']['config_preview'] = config_preview()
+ code, out, _ = run_cmd(['/usr/local/etc/rc.d/pppoe_server', 'status'])
+ bundle['sections']['service'] = {'status': 'ok', 'output': out}
+ try:
+ host, port, username, password = pppoe_console.read_auth()
+ client = pppoe_console.ConsoleClient(host, port, username, password)
+ try:
+ sessions = pppoe_console.parse_sessions(client.run('show sessions'))
+ pools = pppoe_console.parse_ippool(client.run('show ippool'))
+ finally:
+ client.close()
+ bundle['sections']['sessions'] = {'status': 'ok', 'count': len(sessions)}
+ bundle['sections']['pools'] = {'status': 'ok', 'pools': pools}
+ except (OSError, ValueError, ConnectionError) as exc:
+ bundle['sections']['sessions'] = {'status': 'failed', 'message': str(exc)}
+ return bundle
+
+
+def metrics():
+ """Prometheus text exposition (low cardinality: bundle label only)"""
+ lines = []
+
+ def emit(name, value, help_text, mtype='gauge', labels=''):
+ if help_text:
+ lines.append('# HELP %s %s' % (name, help_text))
+ lines.append('# TYPE %s %s' % (name, mtype))
+ lines.append('%s%s %s' % (name, labels, value))
+
+ service_up = 1 if run_cmd(['/usr/local/etc/rc.d/pppoe_server', 'status'])[0] == 0 else 0
+ emit('pppoe_service_up', service_up, 'PPPoE server daemon running')
+
+ try:
+ host, port, username, password = pppoe_console.read_auth()
+ client = pppoe_console.ConsoleClient(host, port, username, password)
+ try:
+ sessions = pppoe_console.parse_sessions(client.run('show sessions'))
+ pools = pppoe_console.parse_ippool(client.run('show ippool'))
+ finally:
+ client.close()
+ except (OSError, ValueError, ConnectionError):
+ sessions, pools = [], []
+
+ emit('pppoe_active_sessions', len(sessions), 'Active PPPoE sessions')
+ by_bundle = {}
+ for session in sessions:
+ by_bundle[session['bundle']] = by_bundle.get(session['bundle'], 0) + 1
+ first = True
+ for bundle, count in sorted(by_bundle.items()):
+ emit('pppoe_sessions_by_ac', count,
+ 'Active sessions per access concentrator' if first else '',
+ labels='{bundle="%s"}' % bundle)
+ first = False
+
+ counters = pppoe_console.get_counters()
+ total_in = sum(counters.get(s['iface'], {}).get('input_bytes', 0) for s in sessions)
+ total_out = sum(counters.get(s['iface'], {}).get('output_bytes', 0) for s in sessions)
+ emit('pppoe_input_bytes_total', total_in, 'Bytes received from clients', 'counter')
+ emit('pppoe_output_bytes_total', total_out, 'Bytes sent to clients', 'counter')
+
+ first = True
+ for pool in pools:
+ labels = '{pool="%s"}' % pool['name']
+ emit('pppoe_pool_addresses_used', pool['used'],
+ 'Addresses in use per pool' if first else '', labels=labels)
+ lines.append('pppoe_pool_addresses_total%s %s' % (labels, pool['total']))
+ first = False
+
+ return '\n'.join(lines) + '\n'
+
+
+def main():
+ parser = argparse.ArgumentParser()
+ parser.add_argument('command', choices=[
+ 'config_preview', 'netgraph_status', 'versions', 'validate',
+ 'support_bundle', 'metrics',
+ ])
+ args = parser.parse_args()
+
+ if args.command == 'metrics':
+ sys.stdout.write(metrics())
+ return 0
+
+ dispatch = {
+ 'config_preview': config_preview,
+ 'netgraph_status': netgraph_status,
+ 'versions': versions,
+ 'validate': validate,
+ 'support_bundle': support_bundle,
+ }
+ result = dispatch[args.command]()
+ # exit 0 with JSON status; configd script_output drops output on failure exit
+ print(json.dumps(result))
+ return 0
+
+
+if __name__ == '__main__':
+ sys.exit(main())
diff --git a/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/expire_users.py b/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/expire_users.py
new file mode 100755
index 0000000000..da901deac5
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/expire_users.py
@@ -0,0 +1,146 @@
+#!/usr/local/bin/python3
+
+"""
+ Copyright (C) 2026 VEQNORA
+ All rights reserved.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+ THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+
+ account expiry job: users listed in users.meta with an expiration date
+ in the past are removed from mpd.secret (mpd5 re-reads the file on
+ every authentication, so no restart is needed) and their active
+ sessions are disconnected. designed to run daily from cron and from
+ the rc.d start_precmd.
+"""
+
+import argparse
+import datetime
+import importlib.util
+import json
+import os
+import re
+import sys
+import tempfile
+
+CONF_DIR = '/usr/local/etc/pppoe_server'
+META_FILE = os.path.join(CONF_DIR, 'users.meta')
+SECRET_FILE = os.path.join(CONF_DIR, 'mpd.secret')
+DATE_RE = re.compile(r'^\d{4}-\d{2}-\d{2}$')
+
+_spec = importlib.util.spec_from_file_location(
+ 'pppoe_console', os.path.join(os.path.dirname(os.path.abspath(__file__)), 'pppoe_console.py'))
+pppoe_console = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(pppoe_console)
+
+
+def expired_usernames(meta_path=META_FILE, today=None):
+ today = today or datetime.date.today()
+ expired = []
+ try:
+ with open(meta_path, 'r', encoding='utf-8') as handle:
+ for line in handle:
+ parts = line.rstrip('\n').split('\t')
+ if len(parts) != 2:
+ continue
+ username, expires = parts
+ if not pppoe_console.USERNAME_RE.match(username) or not DATE_RE.match(expires):
+ continue
+ try:
+ expiry = datetime.date.fromisoformat(expires)
+ except ValueError:
+ continue
+ if expiry <= today:
+ expired.append(username)
+ except OSError:
+ pass
+ return expired
+
+
+def prune_secret(usernames, secret_path=SECRET_FILE):
+ """remove secret lines of the given users; atomic replace, 0600 kept"""
+ if not usernames:
+ return 0
+ try:
+ with open(secret_path, 'r', encoding='utf-8') as handle:
+ lines = handle.readlines()
+ except OSError:
+ return 0
+ blocked = set(usernames)
+ kept, removed = [], 0
+ for line in lines:
+ name = line.split(' ', 1)[0].strip()
+ if name in blocked:
+ removed += 1
+ continue
+ kept.append(line)
+ if removed:
+ fd, tmp_path = tempfile.mkstemp(dir=os.path.dirname(secret_path))
+ try:
+ with os.fdopen(fd, 'w', encoding='utf-8') as handle:
+ handle.writelines(kept)
+ os.chmod(tmp_path, 0o600)
+ os.replace(tmp_path, secret_path)
+ except OSError:
+ os.unlink(tmp_path)
+ raise
+ return removed
+
+
+def disconnect_users(usernames):
+ disconnected = 0
+ try:
+ host, port, username, password = pppoe_console.read_auth()
+ client = pppoe_console.ConsoleClient(host, port, username, password)
+ try:
+ sessions = pppoe_console.parse_sessions(client.run('show sessions'))
+ for session in sessions:
+ if session['username'] in usernames:
+ client.run('session %s' % session['session_id'])
+ client.run('close')
+ disconnected += 1
+ finally:
+ client.close()
+ except (OSError, ValueError, ConnectionError):
+ pass # service not running - nothing to disconnect
+ return disconnected
+
+
+def main():
+ parser = argparse.ArgumentParser()
+ parser.add_argument('--prune-only', action='store_true',
+ help='only rewrite mpd.secret, do not touch sessions')
+ args = parser.parse_args()
+
+ expired = expired_usernames()
+ removed = prune_secret(expired)
+ disconnected = 0 if args.prune_only else disconnect_users(set(expired))
+ print(json.dumps({
+ 'status': 'ok',
+ 'expired': len(expired),
+ 'secrets_removed': removed,
+ 'sessions_disconnected': disconnected,
+ }))
+ return 0
+
+
+if __name__ == '__main__':
+ sys.exit(main())
diff --git a/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/ext_auth.py b/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/ext_auth.py
new file mode 100755
index 0000000000..44c694c765
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/ext_auth.py
@@ -0,0 +1,125 @@
+#!/usr/local/bin/python3
+
+"""
+ Copyright (C) 2026 VEQNORA
+ All rights reserved.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+ THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+
+ mpd5 external authentication backend for local users. This is used
+ instead of mpd.secret when "local shaping" is enabled, because mpd5
+ applies per-session rate limits (ng_car) only from auth parameters
+ (RADIUS or ext-auth) — not from the secrets file.
+
+ Protocol (mpd5 auth.c): mpd writes request lines to our stdin
+ (USER_NAME, AUTH_TYPE, ...) ending with a blank line; we write reply
+ attributes to stdout ending with a blank line. We return the user's
+ cleartext password (mpd verifies PAP/CHAP itself), an optional static
+ Framed-IP-Address, and MPD_LIMIT rules built from the per-user
+ upload/download limits. Passwords are read from a root-only data file
+ and never logged.
+"""
+
+import re
+import sys
+
+DATA = '/usr/local/etc/pppoe_server/users.ext'
+USERNAME_RE = re.compile(r'^[0-9a-zA-Z._@-]{1,64}$')
+
+
+def read_request(stream):
+ # read line-by-line (NOT `for line in stream`, whose block buffering would
+ # deadlock: mpd holds the pipe open waiting for our reply after the blank
+ # line, so the iterator's read-ahead would block forever)
+ req = {}
+ while True:
+ line = stream.readline()
+ if line == '': # EOF
+ break
+ line = line.rstrip('\n')
+ if line == '': # blank line = end of request
+ break
+ if ':' in line:
+ key, val = line.split(':', 1)
+ req[key] = val
+ return req
+
+
+def lookup(username):
+ """return dict with password/up/down/staticip or None"""
+ try:
+ with open(DATA, 'r', encoding='utf-8') as fh:
+ for line in fh:
+ parts = line.rstrip('\n').split('\t')
+ if len(parts) >= 5 and parts[0] == username:
+ return {
+ 'password': parts[1],
+ 'uplimit': int(parts[2] or 0),
+ 'downlimit': int(parts[3] or 0),
+ 'staticip': parts[4],
+ 'ip6route': parts[5] if len(parts) >= 6 else '',
+ }
+ except (OSError, ValueError):
+ return None
+ return None
+
+
+def limit_rule(direction, kbit):
+ """build an mpd MPD_LIMIT rule string for a kbit/s rate"""
+ bps = int(kbit) * 1000
+ burst = max(3000, bps // 100) # ~10 ms of data, floor 3 kB
+ return '%s#1=all rate-limit %d %d' % (direction, bps, burst)
+
+
+def main():
+ req = read_request(sys.stdin)
+ username = req.get('USER_NAME', '')
+ out = sys.stdout
+
+ if not USERNAME_RE.match(username):
+ out.write('RESULT:FAIL\n\n')
+ return 0
+
+ user = lookup(username)
+ if user is None:
+ out.write('RESULT:FAIL\n\n')
+ return 0
+
+ # hand mpd the cleartext password; it performs the PAP/CHAP check
+ out.write('USER_PASSWORD:%s\n' % user['password'])
+ out.write('RESULT:UNDEF\n')
+ if user['staticip']:
+ out.write('FRAMED_IP_ADDRESS:%s\n' % user['staticip'])
+ if user.get('ip6route'):
+ # route a static IPv6 prefix towards this subscriber (see docs/IPV6.md)
+ out.write('FRAMED_IPV6_ROUTE:%s\n' % user['ip6route'])
+ if user['downlimit'] > 0:
+ out.write('MPD_LIMIT:%s\n' % limit_rule('in', user['downlimit']))
+ if user['uplimit'] > 0:
+ out.write('MPD_LIMIT:%s\n' % limit_rule('out', user['uplimit']))
+ out.write('\n')
+ out.flush()
+ return 0
+
+
+if __name__ == '__main__':
+ sys.exit(main())
diff --git a/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/linkdown.sh b/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/linkdown.sh
new file mode 100755
index 0000000000..6752cb497c
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/linkdown.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+# mpd5 iface down-script:
+# flush states owned by the session so traffic stops immediately
+
+/usr/bin/logger -t pppoe -p local3.info "logout,${1},${4},${5}"
+
+/sbin/pfctl -i "${1}" -Fs 2>/dev/null
+/sbin/pfctl -K "${4}/32" 2>/dev/null
+
+exit 0
diff --git a/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/linkup.sh b/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/linkup.sh
new file mode 100755
index 0000000000..7d27c25fe5
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/linkup.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+# mpd5 iface up-script: ...
+# keep clients in a dedicated pf interface group and log the event
+
+/usr/bin/logger -t pppoe -p local3.info "login,${1},${4},${5}"
+/sbin/ifconfig "${1}" group pppoe
+
+exit 0
diff --git a/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/pppoe_console.py b/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/pppoe_console.py
new file mode 100755
index 0000000000..916012b36b
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/pppoe_console.py
@@ -0,0 +1,286 @@
+#!/usr/local/bin/python3
+
+"""
+ Copyright (C) 2026 VEQNORA
+ All rights reserved.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+ THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+
+ mpd5 control console client: list active PPPoE sessions as JSON and
+ disconnect sessions by session id or username.
+
+ "show sessions" emits one TAB separated line per link (mpd 5.9
+ command.c:ShowSessions): ifname, peer-ip, bundle, msession-id, link,
+ link-id, session-id, username, peer-mac and, with the session-time
+ global option enabled, session uptime in seconds.
+"""
+
+import argparse
+import json
+import re
+import socket
+import subprocess
+import sys
+
+AUTH_FILE = '/usr/local/etc/pppoe_server/console.auth'
+SESSION_RE = re.compile(r'^[0-9A-Za-z._-]{1,32}$')
+USERNAME_RE = re.compile(r'^[0-9a-zA-Z._@-]{1,64}$')
+IAC = 255
+
+SESSION_FIELDS = (
+ 'iface', 'address', 'bundle', 'msession_id', 'link',
+ 'link_id', 'session_id', 'username', 'peer_mac', 'uptime'
+)
+
+
+def parse_sessions(payload):
+ """parse raw 'show sessions' output into a list of dicts"""
+ sessions = []
+ for line in payload.splitlines():
+ parts = line.rstrip('\r').split('\t')
+ # 9 columns without, 10 with the session-time option
+ if len(parts) < 9 or not SESSION_RE.match(parts[6]):
+ continue
+ session = dict(zip(SESSION_FIELDS, parts[:10]))
+ session.setdefault('uptime', '')
+ sessions.append(session)
+ return sessions
+
+
+IPPOOL_RE = re.compile(r'^\s*(?P[0-9A-Za-z_-]+):\s+used\s+(?P\d+)\s+of\s+(?P\d+)\s*$')
+
+
+def parse_ippool(payload):
+ """parse mpd5 'show ippool' output: '\t:\tused N of M'"""
+ pools = []
+ for line in payload.splitlines():
+ matched = IPPOOL_RE.match(line)
+ if matched:
+ used = int(matched.group('used'))
+ total = int(matched.group('total'))
+ pools.append({
+ 'name': matched.group('name'),
+ 'used': used,
+ 'total': total,
+ 'free': total - used,
+ })
+ return pools
+
+
+def parse_counters(payload):
+ """
+ parse `netstat -ibn` link-level rows into per-interface counters.
+ ng interfaces have no link address, which shifts the columns, so the
+ trailing fixed fields are taken from the end of the line:
+ ... Ipkts Ierrs Idrop Ibytes Opkts Oerrs Obytes Coll
+ """
+ counters = {}
+ for line in payload.splitlines():
+ parts = line.split()
+ if len(parts) < 10 or '
+ elif verb == 250: # SB ... SE
+ end = data.find(bytes((IAC, 240)), i)
+ i = len(data) if end < 0 else end + 2
+ else:
+ i += 2
+ else:
+ out.append(byte)
+ i += 1
+ return bytes(out)
+
+ def _expect(self, token):
+ while token not in self._buf:
+ self._buf += self._strip_telnet(self._read_chunk())
+ pos = self._buf.find(token) + len(token)
+ consumed, self._buf = self._buf[:pos], self._buf[pos:]
+ return consumed
+
+ def run(self, command):
+ """execute one command, return its output up to the next prompt"""
+ self._send(command)
+ # every reply ends with a prompt like "[] " or "[B1] " on its own line
+ output = []
+ while True:
+ self._buf += self._strip_telnet(self._read_chunk())
+ text = self._buf.decode('utf-8', 'replace')
+ lines = text.split('\n')
+ if lines and self.PROMPT_RE.match(lines[-1]):
+ self._buf = b''
+ output = lines[:-1]
+ break
+ # first echoed line repeats the command itself
+ if output and command in output[0]:
+ output = output[1:]
+ return '\n'.join(output)
+
+ def close(self):
+ try:
+ self._send('quit')
+ except OSError:
+ pass
+ self._sock.close()
+
+
+def read_auth():
+ with open(AUTH_FILE, 'r', encoding='ascii') as fh:
+ for line in fh:
+ parts = line.split()
+ if len(parts) == 4:
+ return parts[0], int(parts[1]), parts[2], parts[3]
+ raise ValueError('malformed console.auth')
+
+
+def main():
+ parser = argparse.ArgumentParser()
+ parser.add_argument('command', choices=['sessions', 'disconnect', 'pool_status'])
+ parser.add_argument('--session', help='session id to disconnect')
+ parser.add_argument('--user', help='disconnect all sessions of a username')
+ parser.add_argument('--bundle', help='disconnect all sessions on a bundle (access concentrator)')
+ args = parser.parse_args()
+
+ result = {'status': 'failed'}
+ try:
+ host, port, username, password = read_auth()
+ client = ConsoleClient(host, port, username, password)
+ try:
+ if args.command == 'pool_status':
+ pools = parse_ippool(client.run('show ippool'))
+ print(json.dumps({'status': 'ok', 'pools': pools}))
+ return 0
+ sessions = parse_sessions(client.run('show sessions'))
+ if args.command == 'sessions':
+ counters = get_counters()
+ for session in sessions:
+ session.update(counters.get(session['iface'], {
+ 'input_packets': 0, 'input_bytes': 0,
+ 'output_packets': 0, 'output_bytes': 0,
+ }))
+ result = {'status': 'ok', 'sessions': sessions}
+ else:
+ targets = []
+ if args.session:
+ if not SESSION_RE.match(args.session):
+ raise ValueError('invalid session id')
+ targets = [s for s in sessions if s['session_id'] == args.session]
+ elif args.user:
+ if not USERNAME_RE.match(args.user):
+ raise ValueError('invalid username')
+ targets = [s for s in sessions if s['username'] == args.user]
+ elif args.bundle:
+ if not SESSION_RE.match(args.bundle):
+ raise ValueError('invalid bundle name')
+ targets = [s for s in sessions if s['bundle'] == args.bundle]
+ else:
+ raise ValueError('nothing to disconnect')
+ for session in targets:
+ client.run('session %s' % session['session_id'])
+ client.run('close')
+ result = {'status': 'ok', 'disconnected': len(targets)}
+ finally:
+ client.close()
+ except (OSError, ValueError, ConnectionError) as exc:
+ result = {'status': 'failed', 'message': str(exc)}
+
+ # always exit 0 with a JSON status payload: configd script_output
+ # discards output on a non-zero exit code, which would hide the error
+ print(json.dumps(result))
+ return 0
+
+
+if __name__ == '__main__':
+ sys.exit(main())
diff --git a/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/radius_test.py b/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/radius_test.py
new file mode 100755
index 0000000000..44424ad4ec
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/scripts/OPNsense/PPPoEServer/radius_test.py
@@ -0,0 +1,173 @@
+#!/usr/local/bin/python3
+
+"""
+ Copyright (C) 2026 VEQNORA
+ All rights reserved.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+ THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+
+ RADIUS reachability test (RFC 2865): sends a PAP Access-Request for a
+ throwaway probe account with a random password. Any valid response
+ (Access-Reject included) proves the server is reachable and the shared
+ secret matches: a wrong secret makes real servers silently discard the
+ request or fail response authentication. No real credentials are used
+ and no secret ever appears on the command line - servers and secrets
+ are read from the generated mpd.conf (root only).
+"""
+
+import argparse
+import hashlib
+import hmac
+import json
+import os
+import re
+import secrets
+import socket
+import struct
+import sys
+
+MPD_CONF = '/usr/local/etc/pppoe_server/mpd.conf'
+SERVER_RE = re.compile(
+ r'^\s*set radius server\s+(?P\S+)\s+(?P\S+)\s+(?P\d+)\s+(?P\d+)\s*$'
+)
+HOST_RE = re.compile(r'^(?:\d{1,3}\.){3}\d{1,3}$')
+
+ACCESS_REQUEST = 1
+ACCESS_ACCEPT = 2
+ACCESS_REJECT = 3
+
+ATTR_USER_NAME = 1
+ATTR_USER_PASSWORD = 2
+ATTR_NAS_PORT_TYPE = 61
+ATTR_MESSAGE_AUTHENTICATOR = 80
+
+CODE_NAMES = {ACCESS_ACCEPT: 'Access-Accept', ACCESS_REJECT: 'Access-Reject', 11: 'Access-Challenge'}
+
+
+def read_servers(path=MPD_CONF):
+ servers = []
+ with open(path, 'r', encoding='utf-8') as handle:
+ for line in handle:
+ matched = SERVER_RE.match(line)
+ if matched:
+ entry = matched.groupdict()
+ if entry not in servers:
+ servers.append(entry)
+ return servers
+
+
+def attr(attr_type, value):
+ return struct.pack('BB', attr_type, len(value) + 2) + value
+
+
+def pap_encrypt(password, secret, authenticator):
+ """RFC 2865 5.2 User-Password obfuscation"""
+ password = password.ljust(16, b'\x00')
+ digest = hashlib.md5(secret + authenticator).digest()
+ return bytes(p ^ d for p, d in zip(password, digest))
+
+
+def build_access_request(secret, authenticator, username, password):
+ attrs = attr(ATTR_USER_NAME, username.encode())
+ attrs += attr(ATTR_USER_PASSWORD, pap_encrypt(password.encode(), secret, authenticator))
+ attrs += attr(ATTR_NAS_PORT_TYPE, struct.pack('!I', 15)) # Ethernet
+ # Message-Authenticator: HMAC-MD5 over the packet with the attribute zeroed
+ attrs += attr(ATTR_MESSAGE_AUTHENTICATOR, b'\x00' * 16)
+ length = 20 + len(attrs)
+ header = struct.pack('!BBH', ACCESS_REQUEST, 1, length) + authenticator
+ mac = hmac.new(secret, header + attrs, hashlib.md5).digest()
+ attrs = attrs[:-16] + mac
+ return header + attrs
+
+
+def verify_response(data, secret, request_authenticator):
+ if len(data) < 20:
+ return None
+ code, ident, length = struct.unpack('!BBH', data[:4])
+ if length > len(data):
+ return None
+ expected = hashlib.md5(
+ data[:4] + request_authenticator + data[20:length] + secret
+ ).digest()
+ if not hmac.compare_digest(expected, data[4:20]):
+ return None
+ return code
+
+
+def probe(server, timeout=5):
+ secret = server['secret'].encode()
+ authenticator = os.urandom(16)
+ packet = build_access_request(
+ secret, authenticator,
+ 'opnsense-probe', secrets.token_urlsafe(16)
+ )
+ sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+ sock.settimeout(timeout)
+ try:
+ sock.sendto(packet, (server['host'], int(server['authport'])))
+ data, _ = sock.recvfrom(4096)
+ except socket.timeout:
+ return {'host': server['host'], 'status': 'timeout',
+ 'detail': 'no response (server down, port blocked or shared secret mismatch)'}
+ except OSError as exc:
+ return {'host': server['host'], 'status': 'error', 'detail': str(exc)}
+ finally:
+ sock.close()
+
+ code = verify_response(data, secret, authenticator)
+ if code is None:
+ return {'host': server['host'], 'status': 'invalid',
+ 'detail': 'response failed authenticator check (shared secret mismatch)'}
+ return {'host': server['host'], 'status': 'ok',
+ 'detail': 'received %s (server reachable, shared secret valid)'
+ % CODE_NAMES.get(code, 'code %d' % code)}
+
+
+def main():
+ parser = argparse.ArgumentParser()
+ parser.add_argument('--host', help='test only this configured server')
+ args = parser.parse_args()
+
+ # always exit 0 with JSON: configd script_output drops output on failure exit
+ try:
+ servers = read_servers()
+ except OSError as exc:
+ print(json.dumps({'status': 'failed', 'message': str(exc)}))
+ return 0
+
+ if args.host:
+ if not HOST_RE.match(args.host):
+ print(json.dumps({'status': 'failed', 'message': 'invalid host'}))
+ return 0
+ servers = [s for s in servers if s['host'] == args.host]
+
+ if not servers:
+ print(json.dumps({'status': 'failed', 'message': 'no RADIUS servers configured'}))
+ return 0
+
+ results = [probe(server) for server in servers]
+ print(json.dumps({'status': 'ok', 'results': results}))
+ return 0
+
+
+if __name__ == '__main__':
+ sys.exit(main())
diff --git a/net/pppoe-server/src/opnsense/service/conf/actions.d/actions_pppoe_server.conf b/net/pppoe-server/src/opnsense/service/conf/actions.d/actions_pppoe_server.conf
new file mode 100644
index 0000000000..ed2a55f4b5
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/service/conf/actions.d/actions_pppoe_server.conf
@@ -0,0 +1,126 @@
+[start]
+command:/usr/local/etc/rc.d/pppoe_server start
+parameters:
+type:script
+message:starting PPPoE server
+
+[stop]
+command:/usr/local/etc/rc.d/pppoe_server stop
+parameters:
+type:script
+message:stopping PPPoE server
+
+[restart]
+command:/usr/local/etc/rc.d/pppoe_server restart
+parameters:
+type:script
+message:restarting PPPoE server
+
+[status]
+command:/usr/local/etc/rc.d/pppoe_server status; exit 0
+parameters:
+type:script_output
+message:request PPPoE server status
+
+[coa_start]
+command:/usr/local/etc/rc.d/pppoe_server_coa start
+parameters:
+type:script
+message:starting PPPoE CoA listener
+
+[coa_stop]
+command:/usr/local/etc/rc.d/pppoe_server_coa stop
+parameters:
+type:script
+message:stopping PPPoE CoA listener
+
+[coa_restart]
+command:/usr/local/etc/rc.d/pppoe_server_coa restart
+parameters:
+type:script
+message:restarting PPPoE CoA listener
+
+[coa_status]
+command:/usr/local/etc/rc.d/pppoe_server_coa status; exit 0
+parameters:
+type:script_output
+message:request PPPoE CoA listener status
+
+[sessions]
+command:/usr/local/opnsense/scripts/OPNsense/PPPoEServer/pppoe_console.py sessions
+parameters:
+type:script_output
+message:list active PPPoE sessions
+
+[disconnect]
+command:/usr/local/opnsense/scripts/OPNsense/PPPoEServer/pppoe_console.py disconnect --session
+parameters:%s
+type:script_output
+message:disconnect PPPoE session
+
+[disconnect_user]
+command:/usr/local/opnsense/scripts/OPNsense/PPPoEServer/pppoe_console.py disconnect --user
+parameters:%s
+type:script_output
+message:disconnect PPPoE sessions of user
+
+[disconnect_ac]
+command:/usr/local/opnsense/scripts/OPNsense/PPPoEServer/pppoe_console.py disconnect --bundle
+parameters:%s
+type:script_output
+message:disconnect PPPoE sessions on access concentrator
+
+[pool_status]
+command:/usr/local/opnsense/scripts/OPNsense/PPPoEServer/pppoe_console.py pool_status
+parameters:
+type:script_output
+message:request PPPoE address pool status
+
+[radius_test]
+command:/usr/local/opnsense/scripts/OPNsense/PPPoEServer/radius_test.py
+parameters:
+type:script_output
+message:test configured RADIUS servers
+
+[netgraph_status]
+command:/usr/local/opnsense/scripts/OPNsense/PPPoEServer/diagnostics.py netgraph_status
+parameters:
+type:script_output
+message:request Netgraph status
+
+[config_preview]
+command:/usr/local/opnsense/scripts/OPNsense/PPPoEServer/diagnostics.py config_preview
+parameters:
+type:script_output
+message:preview generated PPPoE configuration
+
+[versions]
+command:/usr/local/opnsense/scripts/OPNsense/PPPoEServer/diagnostics.py versions
+parameters:
+type:script_output
+message:show PPPoE server component versions
+
+[validate]
+command:/usr/local/opnsense/scripts/OPNsense/PPPoEServer/diagnostics.py validate
+parameters:
+type:script_output
+message:validate generated PPPoE configuration
+
+[support_bundle]
+command:/usr/local/opnsense/scripts/OPNsense/PPPoEServer/diagnostics.py support_bundle
+parameters:
+type:script_output
+message:generate PPPoE support bundle
+
+[metrics]
+command:/usr/local/opnsense/scripts/OPNsense/PPPoEServer/diagnostics.py metrics
+parameters:
+type:script_output
+message:collect PPPoE server metrics
+
+[expire]
+command:/usr/local/opnsense/scripts/OPNsense/PPPoEServer/expire_users.py
+parameters:
+type:script_output
+message:disconnect and disable expired PPPoE accounts
+description:PPPoE server: expire user accounts
diff --git a/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/+TARGETS b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/+TARGETS
new file mode 100644
index 0000000000..3351a0cc0e
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/+TARGETS
@@ -0,0 +1,8 @@
+mpd.conf:/usr/local/etc/pppoe_server/mpd.conf
+mpd.secret:/usr/local/etc/pppoe_server/mpd.secret
+console.auth:/usr/local/etc/pppoe_server/console.auth
+users.meta:/usr/local/etc/pppoe_server/users.meta
+users.ext:/usr/local/etc/pppoe_server/users.ext
+coa.conf:/usr/local/etc/pppoe_server/coa.conf
+rc.conf.d.coa:/etc/rc.conf.d/pppoe_server_coa
+rc.conf.d:/etc/rc.conf.d/pppoe_server
diff --git a/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/coa.conf b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/coa.conf
new file mode 100644
index 0000000000..dc4fc3c1a2
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/coa.conf
@@ -0,0 +1,5 @@
+{# RADIUS CoA / Disconnect listener config - generated, root only (secret) #}
+{% set coa = OPNsense.pppoeserver.radius.coa|default({}) %}
+port={{ coa.port|default('3799') }}
+secret={{ coa.secret|default('') }}
+allowed={{ coa.allowedclients|default('') }}
diff --git a/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/console.auth b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/console.auth
new file mode 100644
index 0000000000..f77023d515
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/console.auth
@@ -0,0 +1,3 @@
+{# mpd5 control console credentials for management scripts - root only #}
+{% set general = OPNsense.pppoeserver.general|default({}) %}
+127.0.0.1 {{ general.consoleport|default('5005') }} svc {{ general.consolepass|default('') }}
diff --git a/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/mpd.conf b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/mpd.conf
new file mode 100644
index 0000000000..2c2bd54e94
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/mpd.conf
@@ -0,0 +1,117 @@
+{# PPPoE Access Concentrator configuration - generated, do not edit #}
+{% from 'OPNsense/Macros/interface.macro' import physical_interface %}
+{% set general = OPNsense.pppoeserver.general|default({}) %}
+startup:
+{% if general.enabled|default('0') == '1' and general.consolepass|default('') != '' %}
+ set global enable session-time
+ set user svc {{ general.consolepass }} admin
+ set console self 127.0.0.1 {{ general.consoleport|default('5005') }}
+ set console open
+{% endif %}
+
+pppoe_server:
+{% if general.enabled|default('0') == '1' %}
+{% if general.loglevel|default('info') == 'debug' %}
+ log +auth +lcp +ipcp +link +bund +pppoe
+{% endif %}
+{% for pool in helpers.toList('OPNsense.pppoeserver.pools.pool') %}
+{% if pool.enabled|default('0') == '1' %}
+ set ippool add pool_{{ pool.name }} {{ pool.start }} {{ pool.end }}
+{% endif %}
+{% endfor %}
+{% for ac in helpers.toList('OPNsense.pppoeserver.acs.ac') %}
+{% if ac.enabled|default('0') == '1' %}
+ create bundle template B{{ loop.index }}
+{% if general.ipv6|default('0') == '1' %}
+ set bundle enable ipv6cp
+{% else %}
+ set bundle disable ipv6cp
+{% endif %}
+ set iface enable tcpmssfix
+ set iface disable on-demand
+ set iface disable proxy-arp
+ set iface idle {{ ac.idletimeout|default('0') }}
+ set iface session {{ ac.sessiontimeout|default('0') }}
+ set iface up-script /usr/local/opnsense/scripts/OPNsense/PPPoEServer/linkup.sh
+ set iface down-script /usr/local/opnsense/scripts/OPNsense/PPPoEServer/linkdown.sh
+ set ipcp no vjcomp
+{% for pool in helpers.toList('OPNsense.pppoeserver.pools.pool') %}
+{% if pool['@uuid']|default('') == ac.pool %}
+ set ipcp ranges {{ ac.gateway }}/32 ippool pool_{{ pool.name }}
+{% endif %}
+{% endfor %}
+{% if general.dns1|default('') != '' %}
+ set ipcp dns {{ general.dns1 }}{% if general.dns2|default('') != '' %} {{ general.dns2 }}{% endif %}
+
+{% endif %}
+ create link template L{{ loop.index }} pppoe
+ set link action bundle B{{ loop.index }}
+ set link disable multilink
+ set link disable eap
+{% if general.authmethod|default('chap') == 'chap' %}
+ set link disable pap
+ set link enable chap
+{% elif general.authmethod|default('chap') == 'pap' %}
+ set link enable pap
+ set link disable chap
+{% else %}
+ set link enable pap
+ set link enable chap
+{% endif %}
+ set link keep-alive 10 60
+ set link mtu {{ ac.mtu|default('') if ac.mtu|default('') != '' else general.mtu|default('1492') }}
+ set link mru {{ ac.mru|default('') if ac.mru|default('') != '' else general.mru|default('1492') }}
+ set link max-redial 0
+ set link max-children {{ ac.maxsessions|default('') if ac.maxsessions|default('') != '' else general.maxsessions|default('256') }}
+ set auth max-logins {{ general.maxsessionsperuser|default('1') }}
+{% if general.localshaping|default('0') == '1' %}
+ set auth disable internal
+ set auth enable ext-auth
+ set auth extauth-script "/usr/local/opnsense/scripts/OPNsense/PPPoEServer/ext_auth.py"
+{% endif %}
+{% if general.radiusauth|default('0') == '1' or general.radiusacct|default('0') == '1' %}
+{% set ropts = OPNsense.pppoeserver.radius.options|default({}) %}
+{% for srv in helpers.toList('OPNsense.pppoeserver.radius.server', 'priority') %}
+{% if srv.enabled|default('0') == '1' %}
+ set radius server {{ srv.host }} {{ srv.secret }} {{ srv.authport|default('1812') }} {{ srv.acctport|default('1813') }}
+{% endif %}
+{% endfor %}
+ set radius timeout {{ ropts.timeout|default('5') }}
+ set radius retries {{ ropts.retries|default('3') }}
+{% if ropts.srcaddr|default('') != '' %}
+ set radius src-addr {{ ropts.srcaddr }}
+{% endif %}
+{% if ropts.nasip|default('') != '' %}
+ set radius me {{ ropts.nasip }}
+{% endif %}
+{% if ropts.nasid|default('') != '' %}
+ set radius identifier {{ ropts.nasid }}
+{% endif %}
+{% if ropts.messageauth|default('1') == '1' %}
+ set radius enable message-authentic
+{% endif %}
+{% if general.radiusauth|default('0') == '1' %}
+ set auth enable radius-auth
+{% endif %}
+{% if general.radiusacct|default('0') == '1' %}
+ set auth enable radius-acct
+{% if general.acctinterval|default('0') != '0' %}
+ set auth acct-update {{ general.acctinterval }}
+{% endif %}
+{% endif %}
+{% endif %}
+{% if ac.servicename|default('') != '' %}
+ set pppoe service "{{ ac.servicename }}"
+{% elif general.servicename|default('') != '' %}
+ set pppoe service "{{ general.servicename }}"
+{% else %}
+ set pppoe service "*"
+{% endif %}
+{% if ac.acname|default('') != '' %}
+ set pppoe acname "{{ ac.acname }}"
+{% endif %}
+ set pppoe iface {{ physical_interface(ac.interface) }}
+ set link enable incoming
+{% endif %}
+{% endfor %}
+{% endif %}
diff --git a/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/mpd.secret b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/mpd.secret
new file mode 100644
index 0000000000..21258e26d8
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/mpd.secret
@@ -0,0 +1,7 @@
+{# PPPoE server local user secrets - generated, do not edit. root:wheel 0600 enforced by rc.d #}
+{% for user in helpers.toList('OPNsense.pppoeserver.users.user') %}
+{% if user.enabled|default('0') == '1' %}
+{{ user.username }} "{{ user.password }}"{% if user.staticip|default('') != '' %} {{ user.staticip }}{% endif %}
+
+{% endif %}
+{% endfor %}
diff --git a/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/rc.conf.d b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/rc.conf.d
new file mode 100644
index 0000000000..967eaeeb92
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/rc.conf.d
@@ -0,0 +1,5 @@
+{% if helpers.exists('OPNsense.pppoeserver.general.enabled') and OPNsense.pppoeserver.general.enabled == '1' %}
+pppoe_server_enable="YES"
+{% else %}
+pppoe_server_enable="NO"
+{% endif %}
diff --git a/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/rc.conf.d.coa b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/rc.conf.d.coa
new file mode 100644
index 0000000000..fbb6628c8f
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/rc.conf.d.coa
@@ -0,0 +1,7 @@
+{% set coa = OPNsense.pppoeserver.radius.coa|default({}) %}
+{% set general = OPNsense.pppoeserver.general|default({}) %}
+{% if general.enabled|default('0') == '1' and coa.enabled|default('0') == '1' and coa.secret|default('') != '' and coa.allowedclients|default('') != '' %}
+pppoe_server_coa_enable="YES"
+{% else %}
+pppoe_server_coa_enable="NO"
+{% endif %}
diff --git a/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/users.ext b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/users.ext
new file mode 100644
index 0000000000..af1a1b4ce5
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/users.ext
@@ -0,0 +1,6 @@
+{# ext-auth data: usernamepasswordupdownstaticipip6route. root 0600 #}
+{% for user in helpers.toList('OPNsense.pppoeserver.users.user') %}
+{% if user.enabled|default('0') == '1' %}
+{{ user.username }} {{ user.password }} {{ user.uplimit|default('0') }} {{ user.downlimit|default('0') }} {{ user.staticip|default('') }} {{ user.ip6route|default('') }}
+{% endif %}
+{% endfor %}
diff --git a/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/users.meta b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/users.meta
new file mode 100644
index 0000000000..23c46161a8
--- /dev/null
+++ b/net/pppoe-server/src/opnsense/service/templates/OPNsense/PPPoEServer/users.meta
@@ -0,0 +1,6 @@
+{# usernameexpiration-date metadata for the expiry job - no secrets #}
+{% for user in helpers.toList('OPNsense.pppoeserver.users.user') %}
+{% if user.enabled|default('0') == '1' and user.expires|default('') != '' %}
+{{ user.username }} {{ user.expires }}
+{% endif %}
+{% endfor %}