From cd8219dfbcc698a074cb695040ad9ecb72184ce7 Mon Sep 17 00:00:00 2001
From: Scott Ullrich <sullrich@pfsense.org>
Date: Sun, 27 Apr 2008 21:30:00 +0000
Subject: [PATCH] Integrate patch sent to m0n0wall-dev by Peter Allgeyer:

we have configured the captive portal to authenticate users against a
Radius server with reauthentication every minute. When using the MAC
Pass-Through feature, we have problems reaching hosts on the WAN side on
other ports then port 80. The log says, that the connections passes the
filter, but tcpdump tells me that the packet never reaches the next hop
router.

I've found some messages in the captive portal log, which make me
believe, that it has something to do with radius reauthentication:

Apr 22 18:18:20 RADIUS_DISCONNECT: unauthenticated, 00:02:a5:fa:b9:35,
192.168.1.198
---
 etc/inc/captiveportal.inc | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc
index 9f1094470b..94741330c4 100644
--- a/etc/inc/captiveportal.inc
+++ b/etc/inc/captiveportal.inc
@@ -461,6 +461,10 @@ function captiveportal_prune_old() {
         $timedout = false;
         $term_cause = 1;
 
+		/* no pruning for fixed mac address entry */
+		if (portal_mac_fixed($cpdb[$i][3])) {
+			continue; // check next value
+		}
         /* hard timeout? */
         if ($timeout) {
             if ((time() - $cpdb[$i][0]) >= $timeout) {
@@ -1095,4 +1099,25 @@ function getNasIP()
     return $nasIp;
 }
 
-?>
+function portal_mac_fixed($clientmac) {
+	global $g ;
+
+	/* open captive portal mac db */
+	if (file_exists("{$g['vardb_path']}/captiveportal_mac.db")) {
+		$fd = @fopen("{$g['vardb_path']}/captiveportal_mac.db","r") ;
+		if (!$fd) {
+			return FALSE;
+		}
+		while (!feof($fd)) {
+			$mac = trim(fgets($fd)) ;
+			if(strcasecmp($clientmac, $mac) == 0) {
+				fclose($fd) ;
+				return TRUE ;
+			}
+		}
+		fclose($fd) ;
+	}
+	return FALSE ;
+}
+
+?>
\ No newline at end of file