#  Configuration for DHCP for the SQL based IP Pools module (rlm_sqlippool).
#
#  See raddb/mods-available/sqlippool for common configuration explanation
#
#  See raddb/policy.d/dhcp_sqlippool for the "glue" code that allows
#  the RADIUS based "sqlippool" module to be used for DHCP.
#
#  See raddb/sites-available/dhcp for instructions on how to configure
#  the DHCP server.
#
#  The database schemas are available at:
#
#       raddb/mods-config/sql/ippool-dhcp/<DB>/schema.sql
#
#  $Id: 909b93c7ebcbbeb16b123ca38e696790b5771dda $

sqlippool dhcp_sqlippool {
  # SQL instance to use (from mods-available/sql)
  #
  #  If you have multiple sql instances, such as "sql sql1 {...}",
  #  use the *instance* name here: sql1.
  sql_module_instance = "dhcp_sql"

  #  This is duplicative of info available in the SQL module, but
  #  we have to list it here as we do not yet support nested
  #  reference expansions.
  dialect = "mysql"

  # The duration for which a lease is reserved whilst under offer
  offer_duration = 10

  # IP lease duration. (Leases expire even if no DHCP-Release packet is received)
  # Either use the value to be sent to the client or a hard coded one.
  #lease_duration = "%{reply:DHCP-IP-Address-Lease-Time}"
  lease_duration = 7200

  #  The attribute in which the IP address is returned in the reply
  attribute_name = "DHCP-Your-IP-Address"

  #  Assign the IP address, even if the above attribute already exists in
  #  the reply.
  #
#  allow_duplicates = no

  #  The attribute in which an IP address hint may be supplied
  req_attribute_name = "DHCP-Requested-IP-Address"

  #
  #  RFC 2132 allows the DHCP client to supply a unique
  #  identifier ("uid") using Option 61 (DHCP-Client-Identifier)
  #  in which case it must be used as the lookup key for
  #  configuration data.
  #
  pool_key = "%{%{DHCP-Client-Identifier}:-%{DHCP-Client-Hardware-Address}}"
  #
  #  The "uid" is generated by the OS which means that clients
  #  whose BMC piggybacks on the main interface (sharing its MAC,
  #  but generating a distinct uid) and dual-booting clients can
  #  be allocated multiple IPs, consuming more pool entries. To
  #  avoid this you can ignore the RFCs and key the configuration
  #  data based only on the client MAC address.
  #
  #  pool_key = "%{DHCP-Client-Hardware-Address}"

  ################################################################
  #
  #  WARNING: MySQL (MyISAM) has certain limitations that means it can
  #           hand out the same IP address to 2 different users.
  #
  #           We suggest using an SQL DB with proper transaction
  #           support, such as PostgreSQL, or using MySQL
  #       with InnoDB.
  #
  ################################################################

  #  These messages are added to the "control" items, as
  #  Module-Success-Message.  They are not logged anywhere else,
  #  unlike previous versions.  If you want to have them logged
  #  to a file, see the "linelog" module, and create an entry
  #  which writes Module-Success-Message message.
  #
  messages {
    exists = "DHCP: Existing IP: %{reply:${..attribute_name}} (cid %{DHCP-Client-Identifier} chaddr %{DHCP-Client-Hardware-Address} giaddr %{DHCP-Gateway-IP-Address})"

    success = "DHCP: Allocated IP: %{reply:${..attribute_name}} from %{control:Pool-Name} (cid %{DHCP-Client-Identifier} chaddr %{DHCP-Client-Hardware-Address} giaddr %{DHCP-Gateway-IP-Address})"

    clear = "DHCP: Released IP %{DHCP-Client-IP-Address} (cid %{DHCP-Client-Identifier} chaddr %{DHCP-Client-Hardware-Address} giaddr %{DHCP-Gateway-IP-Address})"

    failed = "DHCP: IP Allocation FAILED from %{control:Pool-Name} (cid %{DHCP-Client-Identifier} chaddr %{DHCP-Client-Hardware-Address} giaddr %{DHCP-Gateway-IP-Address})"

    nopool = "DHCP: No Pool-Name defined (cid %{DHCP-Client-Identifier} chaddr %{DHCP-Client-Hardware-Address} giaddr %{DHCP-Gateway-IP-Address})"
  }

  # -*- text -*-
  #
  #  ippool-dhcp/sqlite/queries.conf -- SQLite queries for rlm_sqlippool
  #
  #  $Id: d99e09bfc8559eaf5584c32fb6a94c99e689fee3 $
  
  #  *****************
  #  * DHCP DISCOVER *
  #  *****************
  
  #
  #  SQLite does not implement SELECT FOR UPDATE which is normally used to place
  #  an exclusive lock over rows to prevent the same address from being
  #  concurrently selected for allocation to multiple users.
  #
  #  The most granular read-blocking lock that SQLite has is an exclusive lock
  #  over the database, so that's what we use. All locking in SQLite is performed
  #  over the entire database and we perform a row update for any IP that we
  #  allocate, requiring an exclusive lock. Taking the exclusive lock from the
  #  start of the transaction (even if it were not required to guard the SELECT)
  #  is actually quicker than if we deferred it causing SQLite to "upgrade" the
  #  automatic shared lock for the transaction to an exclusive lock for the
  #  subsequent UPDATE.
  #
  allocate_begin = "BEGIN EXCLUSIVE"
  allocate_commit = "COMMIT"
  
  #
  #  Attempt to find the most recent existing IP address for the client
  #
  allocate_existing = "\
    SELECT framedipaddress \
    FROM dhcpippool \
    JOIN dhcpstatus \
    ON dhcpippool.status_id = dhcpstatus.status_id \
    WHERE pool_name = '%{control:Pool-Name}' \
    AND pool_key = '${pool_key}' \
    AND status IN ('dynamic', 'static') \
    ORDER BY expiry_time DESC \
    LIMIT 1"
  
  #
  #  Determine whether the requested IP address is available
  #
  allocate_requested = "\
    SELECT framedipaddress \
    FROM dhcpippool \
    JOIN dhcpstatus \
    ON dhcpippool.status_id = dhcpstatus.status_id \
    WHERE pool_name = '%{control:Pool-Name}' \
    AND framedipaddress = '%{%{${req_attribute_name}}:-0.0.0.0}' \
    AND status = 'dynamic' \
    AND expiry_time < datetime('now')"
  
  #
  #  If the existing address can't be found this query will be run to
  #  find a free address
  #
  #allocate_find = "\
  #  SELECT framedipaddress \
  #  FROM dhcpippool \
  #  JOIN dhcpstatus \
  #  ON dhcpippool.status_id = dhcpstatus.status_id \
  #  WHERE pool_name = '%{control:Pool-Name}' \
  #  AND expiry_time < datetime('now') \
  #  AND status = 'dynamic' \
  #  ORDER BY expiry_time LIMIT 1"
  
  #
  #  This series of queries allocates an IP address
  #
  #  Either pull the most recent allocated IP for this client or the
  #  oldest expired one.  The first sub query returns the most recent
  #  lease for the client (if there is one), the second returns the
  #  oldest expired one.
  #  Sorting the result by expiry_time DESC will return the client specific
  #  IP if it exists, otherwise an expired one.
  #
  allocate_find = "\
    SELECT framedipaddress, 1 AS o \
    FROM ( \
      SELECT framedipaddress \
      FROM dhcpippool \
      JOIN dhcpstatus \
      ON dhcpippool.status_id = dhcpstatus.status_id \
      WHERE pool_name = '%{control:Pool-Name}' \
      AND pool_key = '${pool_key}' \
      AND status IN ('dynamic', 'static') \
      ORDER BY expiry_time DESC \
      LIMIT 1 \
    ) UNION \
    SELECT framedipaddress, 2 AS o \
    FROM ( \
      SELECT framedipaddress \
      FROM dhcpippool \
      JOIN dhcpstatus \
      ON dhcpippool.status_id = dhcpstatus.status_id \
      WHERE pool_name = '%{control:Pool-Name}' \
      AND framedipaddress = '%{%{${req_attribute_name}}:-0.0.0.0}' \
      AND status = 'dynamic' \
      AND ( pool_key = '${pool_key}' OR expiry_time < datetime('now') ) \
    ) UNION \
    SELECT framedipaddress, 3 AS o \
    FROM ( \
      SELECT framedipaddress \
      FROM dhcpippool \
      JOIN dhcpstatus \
      ON dhcpippool.status_id = dhcpstatus.status_id \
      WHERE pool_name = '%{control:Pool-Name}' \
      AND expiry_time < datetime('now') \
      AND status = 'dynamic' \
      ORDER BY expiry_time LIMIT 1 \
    ) \
    ORDER BY o \
    LIMIT 1"
  
  #
  #   If you prefer to allocate a random IP address every time, i
  #   use this query instead
  #   Note: This is very slow if you have a lot of free IPs.
  #
  
  #allocate_find = "\
  #  SELECT framedipaddress \
  #  FROM dhcpippool \
  #  JOIN dhcpstatus \
  #  ON dhcpippool.status_id = dhcpstatus.status_id \
  #   WHERE pool_name = '%{control:Pool-Name}' \
  #  AND expiry_time < datetime('now') \
  #  AND status = 'dynamic' \
  #  ORDER BY RAND() \
  
  
  #
  #  If an IP could not be allocated, check to see if the pool exists or not
  #  This allows the module to differentiate between a full pool and no pool
  #  Note: If you are not running redundant pool modules this query may be
  #  commented out to save running this query every time an ip is not allocated.
  #
  pool_check = "\
    SELECT id \
    FROM dhcpippool \
    WHERE pool_name='%{control:Pool-Name}' \
    LIMIT 1"
  
  #
  #  This is the final IP Allocation query, which saves the allocated ip details
  #
  allocate_update = "\
    UPDATE dhcpippool \
    SET \
      gateway = '%{DHCP-Gateway-IP-Address}', \
      pool_key = '${pool_key}', \
      expiry_time = datetime(strftime('%%s', 'now') + ${offer_duration}, 'unixepoch') \
    WHERE framedipaddress = '%I'"
  
  
  # ****************
  # * DHCP REQUEST *
  # ****************
  
  #
  #  This query revokes any active offers for addresses that a client is not
  #  requesting when a DHCP REQUEST packet arrives
  #
  start_update = "\
    UPDATE dhcpippool \
    SET \
      gateway = ''', \
      pool_key = ''', \
      expiry_time = datetime('now') \
    WHERE pool_name = '%{control:Pool-Name}' \
    AND pool_key = '${pool_key}' \
    AND framedipaddress <> '%{DHCP-Requested-IP-Address}' \
    AND expiry_time > datetime('now') \
    AND dhcpippool.status_id IN \
    (SELECT status_id FROM dhcpstatus WHERE status = 'dynamic')"
  
  #
  #  This query extends an existing lease (or offer) when a DHCP REQUEST packet
  #  arrives.  This query must update a row when a lease is succesfully requested
  #  - queries that update no rows will result in a "notfound" response to
  #  the module which by default will give a DHCP-NAK reply.  In this example
  #  incrementing "counter" is used to achieve this.
  #
  alive_update = "\
    UPDATE dhcpippool \
    SET \
      expiry_time = datetime(strftime('%%s', 'now') + ${lease_duration}, 'unixepoch'), \
      counter = counter + 1 \
    WHERE pool_name = '%{control:Pool-Name}' \
    AND pool_key = '${pool_key}' \
    AND framedipaddress = '%{%{DHCP-Requested-IP-Address}:-%{DHCP-Client-IP-Address}}'"
  
  
  # ****************
  # * DHCP RELEASE *
  # ****************
  
  #
  #  This query frees an IP address when a DHCP RELEASE packet arrives
  #
  stop_clear = "\
    UPDATE dhcpippool \
    SET \
      gateway = ''', \
      pool_key = ''', \
      expiry_time = datetime('now') \
    WHERE pool_name = '%{control:Pool-Name}' \
    AND pool_key = '${pool_key}' \
    AND framedipaddress = '%{DHCP-Client-IP-Address}' \
    AND dhcpippool.status_id IN \
    (SELECT status_id FROM dhcpstatus WHERE status = 'dynamic')"
  
  
  #
  #  This query is not applicable to DHCP
  #
  on_clear = ""
  
  
  # ****************
  # * DHCP DECLINE *
  # ****************
  
  #
  #  This query marks an IP address as declined when a DHCP Decline
  #  packet arrives
  #
  off_clear = "\
    UPDATE dhcpippool \
    SET status_id = (SELECT status_id FROM dhcpstatus WHERE status = 'declined') \
    WHERE pool_name = '%{control:Pool-Name}' \
    AND pool_key = '${pool_key}' \
    AND framedipaddress = '%{DHCP-Requested-IP-Address}'"
}