EBTables and 802.1X Authentication...

Is there any thing in place that will allow EBTables to use 802.1X Port Authentication?  It would be nice to be able to set up a Linux box with EBTables to only pass traffic from a particular MAC on one interface out one or more other interfaces if it has been authenticated via the 802.1X port authentication protocol (EAP).  Traditionally 802.1X is meant to either logically enable or disable a switch port that a client connects to.  However 802.1X has been extended, namely in access points, to only forward traffic for a given MAC from the wireless side in to the wired side only if the source MAC has been authenticated.

As I understand it, the way that 802.1X works is by having the access point / bridge deny all traffic from the client (supplicant) to the network except for Extensible Authentication Protocol (EAP).  The access point / bridge will then check the returning EAP traffic to see if the MAC in question properly authenticated to the authenticator (authentication server).  Technicaly EAP works by the client (supplicant) sending an EAP authentication request to the authenticator (or device acting as an authenticator) which will then query its configured authentication source.  Usually the authenticator uses a RADIUS back end authentication source.

IMHO 802.1X support would not be that difficult to handle in EBTables with the support of a user space daemon or the likes.  There could easily be a default policy to drop any traffic that is not explicitly allowed from the MAC of an authenticated client.  I would think that the EAP traffic would be DNATed to the MAC of the authenticator which would be runing the EAP daemon.  Said EAP daemon would then receive the EAP traffic and handle it and query the back end authentication system.  If the client was authenticated the MAC of the client would be added to an explicitly allowed (authenticated) table.  If the client was not authenticated then the daemon would close out the EAP session and consider it's job done.  Any subsequent EAP attempts would be treated as new EAP sessions and handled as such save for any brute force logging logic in the EAP daemon.



Grant. . . .


-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl